Repository navigation
VIZRO STUDIO 1.0.1 — security update
Powered by BHP Production.
Production: https://vizro.in
Changes:
- Updated the desktop runtime from Electron 41.0.0 to current stable Electron 45.0.0, including its Chromium/Node runtime updates.
- Blocked Windows reserved device filenames, including COM2–COM9, LPT2–LPT9, superscript aliases and reserved names hidden before additional extensions.
- Rejected ambiguous SMB path components, including trailing periods/spaces and colon/alternate-stream syntax.
- Kept existing user/channel/day authorization, HTTPS origin checks, sandboxing and context isolation.
Validation:
57 source tests pass. All three native targets passed installation/mount and short launch checks on native GitHub runners. Installer hashes were verified before upload. The attached GitHub Actions/Sigstore attestation signs the published-release checksum-verification statement; every installer signature was verified. It is not a claim that this public workflow built the installers.
This is not a malware-free guarantee or a GitHub endorsement. Windows Authenticode and Apple Developer ID/notarization are not included; OS installation warnings may remain. Native binary updates require manual installation. Plugin-controlled settings and pages continue to load online.
Real account login, physical office SMB permissions, midnight rollover and customer-device performance still require acceptance testing.
Signed release-integrity attestation
GitHub Actions/Sigstore signed checksum-verification attestation is attached for all three installers. Signatures verified successfully.
Record: https://github.com/hridayne/VIZRO/attestations/59250355
See VERIFY-RELEASE.txt for verification instructions. This attests release integrity, not installer build provenance or OS publisher signing; the installation warning information above still applies.