Skip to content

v0.1.2

Latest
Latest

Choose a tag to compare

View all tags
@ppkarwasz ppkarwasz released this 25 Jun 12:39
Immutable release. Only release title and notes can be modified.
v0.1.2
This tag was signed with the committer’s verified signature.
ppkarwasz Piotr P. Karwasz
GPG key ID: 89F11DC191AA7042
Verified
Learn about vigilant mode.
c8292f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Make the deny-all entity resolver a non-overridable floor (Xerces and Android) by @ppkarwasz in #29
  • build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #27
  • Extract HardeningDocumentBuilderFactory and reuse the resolver floor by @ppkarwasz in #30
  • Add regression test for external schema-location properties by @ppkarwasz in #31
  • Add SECURITY.md with reporting policy and threat model by @ppkarwasz in #32
  • Fix XInclude hardening: block at resolver level by @thientd in #33
  • Enforce no-host-side-effects promises and clarify threat model by @ppkarwasz in #35
  • Simplify stock JDK XInclude hardening by @ppkarwasz in #36
  • Use a neutral SSRF leak marker in tests by @ppkarwasz in #38

New Contributors

Full Changelog: v0.1.1...v0.1.2

Contributors

thientd, ppkarwasz, and dependabot
Assets 3
Loading