Skip to content

v0.13.3

Choose a tag to compare

View all tags
@justapithecus justapithecus released this 17 Mar 20:27
· 14 commits to main since this release
v0.13.3
4762763
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Harden CI permissions and patch vulnerable transitive dependencies

Summary

Security-focused patch release that enforces least-privilege GITHUB_TOKEN scope across CI workflows and remediates all open Dependabot advisories for transitive devDependencies.

Highlights

  • Add explicit permissions: contents: read to ci.yml, nightly.yml, and release-dry-run.yml — resolves 19 CodeQL code-scanning alerts
  • Patch flatted to 3.4.0 — unbounded recursion DoS in parse() revive phase
  • Patch minimatch to 3.1.4 — ReDoS via nested extglobs (scoped to ^3 to preserve glob@7 compatibility)
  • Patch rollup to 4.59.0 — arbitrary file write via path traversal
  • Patch basic-ftp to 5.2.0 — path traversal in downloadToDir()
  • All patched packages are transitive devDependencies only — zero production impact

Known Limitations

  • Overrides are pinned to exact remediated versions; upstream packages have not yet bumped their own dependency ranges

Full Changelog: v0.13.2...v0.13.3

Assets 15
Loading