Skip to content

0.4.7

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 02:36
· 20 commits to main since this release
v0.4.7
1a5ee15
This commit was signed with the committer’s verified signature.
freakboy3742 Russell Keith-Magee
GPG key ID: 3D2DAB6A37BB5BC3
Verified
Learn about vigilant mode.

This is a security release addressing 2 known issues:

  • (GHSA-j2qc-j92x-qqhj) The mechanism used by Briefcase to construct cache filenames has been strengthened to remove the ability for a malicious server to write arbitrary content into a Windows file system. This problem is known to exist in all versions of Briefcase from v0.3.0 to v0.4.6; however, the download hashing added in v0.4.5 makes the bug extremely difficult for an attacker to exploit. Full details can be found in GitHub Security Advisory GHSA-j2qc-j92x-qqhj; a CVE has been requested. (#3110)
  • The minimum version of pip required by Briefcase has been bumped to 26.2.2 to ensure that the eMudhra Intermediate CA is not in use. (#3111)
Assets 6
Loading