Skip to content

Release v0.9.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Nov 11:46
· 11 commits to main since this release
v0.9.0
e188d56
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • release: v0.9.0 (#963) (e188d56)
  • feat(core)!: typed creation errors, handle-relative link resolution, durability and RAM spool accounting (#961) (128214b)
  • fix(core): refuse ambiguous TAR extension header chains (#957) (5c5060f)
  • feat(core)!: request API, staged create, typed errors and binding parity (#954) (dcb72a4)
  • docs(specs): sync specs with changes since v0.8.0 (#948) (cf6a906)
  • docs(specs): update specs for typed creation max file size, sink decode reuse, ZIP_READER and landing length parity (#947) (f3e8595)
  • fix(core)!: relative-length landing parity, typed creation max file size, opt-in sink decode reuse, ZIP_READER sub-code (#946) (c23ec3a)
  • fix(core)!: type InvalidArchive and config errors, reuse ZIP census decode, bound skipped TAR decode, refuse long symlink landings (#894) (1b49ca6)
  • feat(core)!: type archive sizes, hardlink targets, config entries and security violations (#888) (e6bf289)
  • ci: run release-profile tests on main only (#886) (28d4e85)
  • fix(core)!: decode ZIP entries once, bound TAR skip drains, vet path parents by type, share callback extraction (#884) (be34a89)
  • fix(core)!: pin Windows destination writes to a directory handle, add TAR sub-codes to bindings, lint Windows in CI (#865) (766ef50)
  • fix(core)!: bound zstd window, cap compressed members, type TAR trailer refusals, abort Node buffer calls (#856) (9233db9)
  • fix(core)!: verify gzip trailer on TAR extraction, type TAR payload refusals, close ZIP descriptor tails, add Node AbortSignal (#848) (4121140)
  • fix(core)!: skip the parent realpath for walker-backed targets, type TAR ambiguities, unify extension allowlist order (#846) (7e9f730)
  • fix(core): pin destination writes to directory descriptors, add entry callbacks, single-decode atomic TAR (#842) (f33a779)
  • fix(core)!: make ZIP and TAR structure checks consistent with streaming readers (#837) (08e9c92)
  • fix(core): refuse non-canonical checksum/size in TAR extension headers and PAX record framing (#829) (f631141)
  • feat(core)!: name blocking parents in extract and verify, decode compressed TAR once, typed in-memory request (#828) (58fa226)
  • fix(core): close remaining gaps in ZIP descriptor-entry verification (#827) (96a82cd)
  • fix(core)!: make TAR header and PAX/GNU extension parsing consistent with reference readers (#820) (771c49d)
  • fix(core): keep overwrite temp name length independent of the entry name (#822) (ec296cf)
  • fix(core): harden ZIP verification of data-descriptor entries (#821) (0c1d5f1)
  • fix(core): replace the destination entry on overwrite instead of writing through its inode (#819) (953bafb)

Installation

Rust

[dependencies]
exarch-core = "0.9.0"

Python

pip install exarch==0.9.0

Node.js

npm install exarch-rs@0.9.0

Rust CLI

cargo install exarch-cli

Or download a prebuilt exarch-0.9.0-<target> archive from this release's assets
(or run curl -fsSL https://raw.githubusercontent.com/bug-ops/exarch/main/scripts/install.sh | sh),
both of which skip the Rust toolchain requirement.

Artifacts

  • Python wheels for Linux (x86_64, aarch64), Linux musl (x86_64, aarch64), macOS (x86_64, aarch64), Windows (x86_64)
  • Node.js native addons for Linux (x86_64, aarch64), macOS (x86_64, aarch64), Windows (x86_64)
  • CLI binaries for Linux (x86_64, aarch64), macOS (x86_64, aarch64), Windows (x86_64) as
    exarch-0.9.0-<target>.tar.gz / .zip with .sha256 checksums, plus install.sh
  • Published to crates.io, PyPI, and npm
Assets 25
Loading