Qwen Code v0.19.1 Changelog

This update is a crucial maintenance release for developers using Qwen Code, especially those running automated workflows or connecting to external servers. It primarily tightens up security and validation—meaning the software is much better at catching bad inputs before they can cause problems, while also fixing a major bug that could have accidentally wiped out files.

What's new

• Smarter server connections: The tool can now discover MCP (Model Context Protocol) servers automatically and match resources by their names. MCP is just a standard way for AI models to connect to outside tools and data.
• High-contrast cursor: The interface now uses a highly visible software cursor, making it much easier to see where you are typing, especially if you have trouble with low-contrast screens.

Improvements

• Better terminal themes: The app now only paints a custom background color if it actually matches your terminal window, preventing ugly color clashes on your screen.
• Smoother automated testing: The system that checks and merges code updates will automatically retry if a temporary glitch happens, instead of just failing right away.

Fixes

• Prevented accidental file deletion: Fixed a severe security bug in the workflow system. Previously, a specially crafted ID could trick the system into deleting files it wasn't supposed to (a "path-traversal" attack). It now strictly checks the ID before deleting anything.
• Stopped cross-repo auto-approvals: The automated triage system will no longer automatically approve pull requests (code updates) that refactor code across different repositories, preventing risky changes from slipping through.
• Rejected bad scheduled prompts: Fixed an issue where blank "cron prompts" (scheduled, automated commands) could be saved and run by mistake.
• Fixed file encoding glitches: Prevented the system from accidentally writing duplicate BOMs (Byte Order Marks). A BOM is a hidden piece of text at the start of a file that can mess up how the file is read if it's duplicated.
• Enabled code analysis in ACP mode: The /lsp command (which uses a Language Server Protocol to check your code for errors) now works properly in ACP mode.
• Skipped broken configs: The tool will now quietly ignore A2UI configurations that are broken or unusable, rather than crashing.
• Stricter number checks: The system now requires whole numbers (integers) for things like media byte limits, compaction counts, and list limits. Before, if you accidentally used text or decimals, it could cause errors.
• Rejected invalid data: The tool now blocks bad "cursors" (markers used to keep track of where you are in a list of saved sessions), unsupported extension scopes, and wrong channel credential types.
• Reverted a complex change: The developers rolled back a change that tried to separate the "Protocol enum" (a list of communication rules) from the model's identity, because it wasn't working as intended.

Breaking changes

No breaking changes in this release.