Edi Life OS 1.1.0 fixes XSS and merges MCP read tools

Edi Life OS v1.1.0 was published on October 10, 2026 on the edrisranjbar/lifeos GitHub repository. The release notes describe it as security fixes, a leaner MCP server and a display currency setting for the self-hosted life OS.

Release facts

What changed

• Dashboard XSS fixed. Goal titles, categories, metrics and finance category names are now escaped before rendering. The notes say these values can be written through the API, so this was the most important fix.
• Login and session hardening. The login redirect must be a same-origin path, Habittify write requests need the session CSRF token, and sign-in returns 429 with Retry-After after 5 failed attempts from one client in 15 minutes.
• Security headers and proxy setting. Content-Security-Policy, X-Frame-Options: SAMEORIGIN, Referrer-Policy and X-Content-Type-Options are now sent on every response. A new LIFEOS_TRUST_PROXY setting handles HTTPS behind a reverse proxy.
• One MCP read tool. The 12 read-only MCP tools become a single lifeos_query tool with a type. The notes say fewer tools means less context used in every conversation.
• Display currency. Settings now offers 13 currencies, including USD, EUR and JPY. Amounts are labels only and are never converted.

Upgrading: the release notes say the new login_throttle table is created automatically, and MCP clients need mcp/ updated and restarted.

Questions

Do MCP prompts need changes? According to the release notes, prompts that named an old read tool such as lifeos_list_goals now go through lifeos_query.

Is a manual migration required? The release notes say no manual migration is needed; the login_throttle table is created automatically.

Does the currency setting convert amounts? No. The release notes say amounts are labels only and are never converted.

See the Edi Life OS hub, the Agent infra category, or the related Mastra core 1.76.0 launch.