Release Notes
Fixed
- Security — credential leak in logs. The app token (embedded in
registration paths) and S3 SigV2 signatures (in presigned-PUT query strings)
no longer reach error messages or logs. A transport-error path echoed the full
reqwest URL at the DEFAULT log level — and to the xcode post-action daemon
log file — leaking both; it now scrubs the URL (without_url()), and the
debug-level URL log fields are redacted via a shared redact_url helper.
Changed
- Hardening from an adversarial review:
update refuses a non-HTTPS download base except loopback, and caps
artefact (512 MiB) / metadata (1 MiB) download sizes so a hostile or
misconfigured origin can't OOM the host before the SHA-256 check.update archive extraction lists and rejects absolute / ..-traversal
entries before unpacking.sourcemaps inject rejects .. / absolute //# sourceMappingURL= targets,
so a crafted bundle can't steer it at a file outside the bundle directory.- per-
.so native-upload staging ZIPs are uniquely named, preventing a path
collision under concurrent upload if two libraries shared a build-id.
- chunked-upload buffers are bounded to the actual chunk length instead of the
raw server-provided chunk_size (a large chunk_size for a small artefact
no longer over-allocates).
Install bugsee-cli 0.7.3
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/bugsee/bugsee-cli/releases/download/v0.7.3/bugsee-cli-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/bugsee/bugsee-cli/releases/download/v0.7.3/bugsee-cli-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install bugsee/tap/bugsee-cli
Install prebuilt binaries into your npm project
npm install @bugsee/bugsee-cli@0.7.3
Download bugsee-cli 0.7.3
