Skip to content

v4.2.1

Latest
Latest

Choose a tag to compare

View all tags
@electron-npm-package-publisher electron-npm-package-publisher released this 21 Jul 11:23
v4.2.1
0959a13
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

4.2.1 (2026-07-21)

Bug Fixes

  • add circular symlink detection and depth limit protection (#423) (fd0fcd8)
  • add DoS validation for asar archive headers and file entries (#419) (51cd188)
  • add header validation for ASAR archives (#421) (00e5293)
  • add offset validation to readFileSync to prevent out-of-bounds reads (#420) (97c09cc)
  • add path validation to prevent directory traversal attacks (#418) (de0689b)
  • compute integrity over transformed bytes when a transform is applied (#450) (8c9be01), closes #277
  • constrain extractFile reads to the unpacked directory (#451) (1f4b01d)
  • improve symlink validation to prevent directory traversal attacks (#422) (c43f92b)
  • replace commander with native Node.js parseArgs (#416) (42b25d0)
  • resolve absolute symlink targets correctly when packing (#452) (0087cfa), closes #366
Assets 2
Loading