Skip to content

v1.4.1

Choose a tag to compare

View all tags
@kauffinger kauffinger released this 27 May 12:58
Immutable release. Only release title and notes can be modified.
v1.4.1
900eda3
This commit was signed with the committer’s verified signature.
kauffinger Konstantin Auffinger
SSH Key Fingerprint: qCn/Y2Tx37K72a6wy/E+QU+tICchIFNthYUAS0XS4Nw
Verified
Learn about vigilant mode.

What's changed

  • Fail closed when integrity lock entries are malformed or package metadata drifts.
  • Keep integrity checks enabled when using SOAK_TIME_SKIP; skips now affect freshness filtering only.
  • Pin source installs by source reference and source URL.
  • Filter packages with missing release dates, while allowing Composer platform packages like php and ext-*.
  • Add a short SECURITY_MODEL.md describing the threat model, trust boundary, and limits.
Assets 3
Loading