Skip to content

Lineage v1.0.1

Choose a tag to compare

View all tags
@priyam-jain-2002 priyam-jain-2002 released this 23 Aug 22:30
v1.0.1
3cd86f5

Security patch release for the V1 line.

Includes safety hardening for released functionality:

  • rejects unsafe manifest name/version characters
  • fails closed when registry pull responses omit digest data
  • fixes repeated confirmation prompts sharing reader state
  • scans bounded prefixes in large files instead of skipping secret content entirely
  • prevents add from reporting readiness when enable/setup did not complete
  • writes important state atomically
  • closes setup TOCTOU gaps
  • rejects symlinked package entrypoints
  • caps archive extraction size to reduce decompression-bomb risk
  • detects materialized skill directory collisions
  • keeps disable re-materialization behind confirmation
  • recognizes shims by content to avoid recursion
  • caps materialized file permissions instead of copying unsafe source modes

This patch intentionally excludes post-v1.0 feature work from develop, including the local graph/snapshot subsystem.

Assets 8
Loading