Skip to content

v0.10.1 — linear normalize (ReDoS fix)

Choose a tag to compare

View all tags
@biznuts biznuts released this 19 Jun 14:56
v0.10.1
0ecc5b1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes a ReDoS surface in the documented body-hash one-liner (/never-stale:setup and /never-stale:status). The old /\s+$/ (plus /^\n+|\n+$/g) backtracks catastrophically on a long run that never reaches the anchor — a single ~200 KB line of spaces measured ~21.6 s. Both one-liners now use the same linear char-scan normalization the gate and the hash-mode preview already use.

  • Hash-compatible: linear and regex forms produce byte-identical hashes for all realistic bodies (verified against the dogfood fence hash) → no recorded hash changes, no migration.
  • A guard test runs the real shipped one-liner and asserts it stays linear and never reintroduces /\s+$/.
  • Roadmap honesty: version / declared modes documented as deferred and not planned (reserved no-ops).

This line also adopts hash-mode dogfooding in the repo (pairs the gate to its design doc). No plugin behaviour change vs 0.10.0 when syncPairs is unconfigured.

Full notes: CHANGELOG.md.

Assets 2
Loading