v0.2.7

Security release. Upgrade from 0.2.6 or earlier.

Review

• One rule decides an install-time hold: the release holds when the install-time surface changed against the previous version. README, docs and CI workflow files are never part of that surface.
• An install hook entry is read for what it can load. A hook that runs a file in any language (shell, Python, Ruby, Perl and others) is followed to the files it names; a path built at run time is bounded by its literal prefix and holds the files in that directory, a path with no usable prefix holds the package without its docs, and a fully computed load holds every file.
• Shell hooks: a variable that names a path is trusted only when its whole value is a plain word. eval, ./source, cd/pushd/popd, printf -v and array-element writes widen the file to every file, quoted or not.
• Python hooks: import_module, run_module and run_path calls, aliased or bare, are followed like __import__; a stdlib import closes its shadow files; an import after a colon and a literal dynamic import are read.
• An install statement from the allow-list counts as static only when its arguments are literal too.
• Update targets load through a plugin registry, so a target can keep its own older names outside the public tree.
• The public export leaves out paths listed in .publish-exclude, and the oss-scan host-name list is read from a private file.

Holds in this release

• Packages whose install hook runs a fully computed load are held for a human read; their changed hook entries are shown whole.