Skip to content

v1.0.2

Latest
Latest

Choose a tag to compare

View all tags
@jcwang587 jcwang587 released this 01 Nov 20:52
· 8 commits to main since this release
v1.0.2
d82153b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release: BRML and RASX archives are read with zip 9.1.3.

Security

  • zip 9.1.3 fixes GHSA-m665-v7pm-7grj, a critical parser differential in ZIP archives that affects zip 9.0.4 and older. geddes reads archive members into memory and never writes them to disk (#74).

Fixed

  • An npm release that stops after some platform packages are published can be completed. The publisher skips versions already on npm when their SHA-512 and release tag match the tested tarball, and a manual sourceRunId input republishes the original tested archive (#69).

Dependencies

  • zip 9.1.3.

Full changelog: v1.0.1...v1.0.2

Assets 2
Loading