Skip to content

v0.2.8

Choose a tag to compare

View all tags
@alsoknownaswill alsoknownaswill released this 29 Oct 04:23
· 35 commits to main since this release
v0.2.8
This tag was signed with the committer’s verified signature.
alsoknownaswill Will Lin
SSH Key Fingerprint: 0RLg2YPZHl5kTxhLHLFcG6aZ6Ui+pxtVmP7zvGAWaA8
Verified
Learn about vigilant mode.
572f7e3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Upgrade from 0.2.7 or earlier.

Review

  • A dependency whose lower bound falls (for example ^4.0.0 to ^1.7.3) now counts as an install-time change, because npm installs a different package and runs its install scripts. The check follows the spec npm installs for each name: optionalDependencies, else dependencies, else peerDependencies, with npm: aliases resolved, every || alternative read, and a version it cannot read held.
  • A changed or added npm-shrinkwrap.json is part of the install-time surface.
  • A version Bun cannot order is treated as unread instead of stopping the review.

Eval

  • New eval function-color-postinstall-hidden-download: four attack pull requests (install and update of function-color and function-flag) and five look-alikes and controls. oUpdate 0.2.8 blocks 4 of 4 attacks and passes 5 of 5 look-alikes and controls. The README explains how scoring works.
Assets 2
Loading