Skip to content

0.8.0

Choose a tag to compare

@xansec xansec released this 11 Jun 18:42
· 49 commits to main since this release

Full Changelog: 0.7.7...0.8.0

This includes everything from 0.7.8, but bumping to subminor change since this is a breaking change for this rule.

This release includes a breaking change and security update. Previously, Mayhem tokens passed by --action_env could be read in the logs of the remote Bazel cache. Normally, this would only be an issue if an external party had access to the bazel cache. However, some customers share their cache across their organization, which would allow members of one team to view the logs in the cache from another team. Tokens are cheap and easy to regenerate, but Mayhem does not enforce an expiration for tokens, so these leaks can become a problem. The new solution uses a credential file in the user's Bazel workspace to provide credentials for login instead, keeping them out of the remote cache.