Skip to content

v0.1.78

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 08:29
v0.1.78
7660ee0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

Repository-provided setup, run and teardown commands now require your approval before they run. (GHSA-923q-2hmp-prq3, High, CVSS 7.8)

Factory Floor reads these commands from .factoryfloor.json in a project's root, and from the .emdash.json, conductor.json and .superset/config.json compatibility fallbacks. In earlier versions the setup command ran automatically the first time a workstream's workspace opened, and teardown ran automatically when a workstream was archived, with its output discarded. Neither asked for approval. Adding an untrusted repository and creating a workstream for it could therefore execute a command that the repository supplied, on your machine, under your user account, with no prompt. Because the compatibility fallbacks are honoured too, a repository that has never heard of Factory Floor can carry such a config.

What changes:

  • The workspace shows every command and the config file it was read from, and runs nothing until you approve it.
  • Approval is bound to the command text, so an edited config is presented for approval again rather than inheriting the earlier decision.
  • Approval can be withdrawn from the Info tab, which also stops a run script that is already running.
  • Approvals are not carried over for repositories you had already added. Existing projects are presented for approval the next time you create a workstream.

If you use Factory Floor to look at code you did not write, including pull requests from third parties, this is worth upgrading for.

Reported by AI Census Labs and Junjie He (@glmgbj233).

About 0.1.77

The 0.1.77 tag contains the same fix in source, but its release build failed and produced no downloadable artifact. 0.1.78 is the first installable release carrying the fix, which is why the advisory records everything below 0.1.78 as affected.

0.1.78 (2026-07-30)

Bug Fixes

  • build: restore ghostty submodule gitlink (233c9c8)
Assets 4
Loading