Skip to content

v1.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Aug 09:53
· 60 commits to main since this release
v1.0.1
5a77dbf

@npm-safe v1.0.1 — Security Patch

Patch release. The npm package now ships with the undici 8.x security fix.

Security

  • Upgrade undici to 8.x — addresses known HTTP/request-smuggling and response-queue CVEs in the 7.x line. The registry client's proxy support (ProxyAgent) now uses a patched runtime.
  • Pin the Neutralinojs CLI (@neutralinojs/neu@11.0.0) in the release workflow to eliminate the npx rug-pull risk from unpinned transitive updates.

Fixes

  • CLI --version test now accepts any semver (was hardcoded to 0.x).

Install

npm install -g @npm-safe/core@1.0.1

Or as a library:

npm install @npm-safe/core@1.0.1

Links

Assets 5
Loading