v0.7.7

Overview

A variety of bugs and security fixes, while making buffered web unpacking up to 3× faster ☘️

• fix(path): replace pre-existing link leaves without following them by @ayuhito in #134
• perf(web): skip redundant buffer allocation by @ayuhito in #135
• perf(pax): use flag for header check by @ayuhito in #136
• fix(fs): harden pack against source swaps by @ayuhito in #137
• fix(fs): snapshot caller pack sources by @ayuhito in #138
• fix(fs): validate symlink graph after extraction by @ayuhito in #139
• fix(fs): reject symlink graph follow overflow by @ayuhito in #140
• fix(fs): harden unpack parent races by @ayuhito in #141
• perf(web): speed up buffered unpack by @ayuhito in #142
• fix(fs): reject symlink hardlink targets by @ayuhito in #144
• fix(pax): cap tar metadata entries by @ayuhito in #143
• fix: preserve equals signs in PAX values by @ayuhito in #145
• fix(fs): prevent symlink parent races by @ayuhito in #146
• fix(fs): validate symlinks against destination state by @ayuhito in #149
• fix: preserve tar entry boundaries with PAX metadata by @ayuhito in #150
• fix(fs): prevent directory packing readdir race by @ayuhito in #147
• fix(fs): preserve unicode path spelling by @ayuhito in #151
• fix(fs): restore concurrent file opens during unpack by @ayuhito in #152
• perf(fs): avoid redundant pack file operations by @ayuhito in #153
• perf(fs): streamline hardlink finalization by @ayuhito in #154
• perf(fs): reduce symlink validation overhead by @ayuhito in #155
• perf(fs): validate symlinks concurrently by @ayuhito in #156
• perf(fs): overlap hardlink finalization reads by @ayuhito in #157
• fix: prevent malformed pax record hangs by @ayuhito in #159
• chore: upgrade dependencies by @ayuhito in #158

Full Changelog: v0.7.6...v0.7.7