Skip to content

v1.2.1

Choose a tag to compare

View all tags
@7nohe 7nohe released this 21 Jul 06:26
v1.2.1
638988b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@guren/cli 1.2.1 (patch)

Fix guren plugin publishes and plugin CLI command discovery for locally installed plugins (file:, link:, workspace: protocols).

Bun materializes these as per-file symlinks into the source directory, which the path-escape guard misclassified as escaping the package directory — publishes aborted guren plugin with a hard error, and declared CLI commands were silently dropped from guren --help/invocation. The guard now also accepts the package's content root (the realpath parent of its package.json), which equals the node_modules entry for regular npm installs and the source directory for per-file-symlink local installs. Malicious symlinks pointing outside both roots are still rejected.

Discovered while dogfooding the v1.3.0 plugin system end-to-end (authoring a real plugin with definePlugin(), a full gurenPlugin manifest, and a contributed CLI command, then installing it locally into a fresh app) — the standard "test your plugin locally before publishing" workflow was broken by this bug.

Full Changelog: v1.3.0...v1.2.1

Assets 2
Loading