Skip to content

v0.18.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jul 10:41
· 79 commits to main since this release
v0.18.6
63162eb

v0.18.6 (2026-07-24)

Here's the changelog for everything since v0.18.5 (July 7, 2026):

Fixed

  • Plugin install/uninstall/upgrade made transactional — operations now use atomic same-filesystem renames via a trash area ($IDAUSR/.plugins-trash/). Interrupted installs no longer leave wedged state; locked plugins on Windows fail cleanly with "close IDA" instead of half-destroying the installation. (#264, closes #228)
  • Plugin settings with falsy defaults — default=False or default="" in plugin config was treated as "no default", breaking non-interactive installs. Now uses is None check. (#263, closes #242)
  • Install script 404 errors — replaced fragile API-based asset download with direct GitHub download URLs, fixing broken docs/install on minified API responses. (#262, closes #256)
  • hcli update ETXTBSY on Linux — the running binary is now renamed aside before replacing (strategy already used on Windows), avoiding "Text file busy" errors when temp dir is on a different filesystem. (#261, closes #255)
  • ida install on existing directory — pre-checks the target directory and gives actionable messages ("already installed" with switch/remove suggestions, or "directory exists" for non-IDA dirs) instead of a stack trace. (#259, closes #252)
  • ida install -a/--accept-eula was inverted — Click flag gotcha where presence of -a toggled to False. Now a proper on/off toggle (-a/-A). (#250, closes #249)
  • ida open rejected valid ida:// URLs — ida://source/idb-name and ida:///idb-name without a resource segment now work, defaulting to functions. (#247, closes #246)
  • get_hcli_executable_path quoting — all branches now return a consistently shell-quoted command, fixing breakage on paths with spaces. (#227)
  • python -m hcli didn't work — added __main__.py so python -m hcli is a valid entrypoint. (#226)
  • Asset API leading slash — stripped leading / from keys in asset API paths, fixing silent no-ops when pasting keys from CLI output. (#215)
  • Plugin repo fetched unnecessarily — uninstall, config, and lint subcommands now skip the network fetch since they don't need it. (#258, closes #257)
  • Windows binary missing python3.dll — bundled the DLL so .pyd loading (needed for EULA acceptance) works. (#251)

Security

  • Hardened ida:// KE deep-link handler — fixed RCE via dialog string injection, path traversal, SSRF (with DNS-rebinding-resistant IP pinning), and drive-by auto-open. Native confirmation dialog now shown before opening downloaded content. (#229)

Changed

  • CI: updated and pinned GitHub Actions, fixed zizmor findings. (#253)

This release is published under the MIT License.

Detailed Changes: v0.18.5...v0.18.6

Assets 6
Loading