v2.30.4. #264
v2.30.4. #264
Conversation
This change was not made by me. It was published to Atmosphere, but never pushed to GitHub. This resolves that discrepancy, for the sake of posterity. The contents of this change were obtained by fetching the package sources of v2.30.2 and v2.30.3 from the Meteor package server (warehouse.meteor.com), and "diff"-ing them: meteorhacks:kadira@2.30.2: http://bit.ly/2ys7h0U meteorhacks:kadira@2.30.3: http://bit.ly/2C6JcyX (links shortened for commit message) As far as what this commit appears to do (based on my assessment): This ensures that an error message which is purely a string (rather than an `Error` object), is properly encapsulated in an `Error`-like object so it can be properly transmitted to the APM server.
|
FYI, The failing tests are unrelated to the change. Rather, they are failing because the Kadira account they are being tested against is no longer active. |
|
Giving more information about this might increase the risk of it being abused, so I understand if what I'm asking for is not possible at the moment. But how is |
|
I can understand your inquisition! We do plan on elaborating on this at some point (not here, but in a blog post, most likely), but we feel it's in the best interest of the community to first publicize the importance of updating, and follow-up with additional information later on. I'm glad it's not immediately clear, but I'd probably encourage anyone who might figure it out to understand the impact that publicizing those details might have. Sorry this isn't the answer you're looking for, but I hope you'll understand. |
Meteor Development Group has just published version v2.30.4 of
meteorhacks:kadiraon behalf of the package author. This PR serves to represent the changes which were included in that version. Most notably, 9d536d6, which is an important fix for any user of themeteorhacks:kadirapackage.The other functional change included in this PR, 209c351, was already published in
meteorhacks:kadirav2.30.3, but those changes were not reflected on the GitHub repository. This commit has been included for the sake of continuity, and aims to clearly indicate what we have published.Whether or not this PR is merged, downstream package authors are advised to include this fix in their forks.
For more information: https://blog.meteor.com/denial-of-service-disclosure-for-meteor-apm-kadira-agent-c6c86abc0035