Skip to content

v0.47.2

Choose a tag to compare

View all tags
@rustyconover rustyconover released this 27 Sep 17:48
· 52 commits to main since this release
v0.47.2
026a7b2

Security: require httpx2 >= 2.12.0

Every httpx2 requirement (the http, cli and iroh extras) now requires httpx2>=2.12.0, up from >=2.9.1, which let a fresh install resolve a vulnerable version. It fixes three advisories:

  • GHSA-8xx6-hgc6-gc2m (high): streaming response decompression did not bound peak memory, so a hostile server could exhaust a client's memory with a small compressed response.
  • GHSA-h4x7-gw46-3wm6 (medium): multipart part header injection via unvalidated file Content-Type and custom headers.
  • GHSA-pf96-p4fj-6566 (medium): conflicting Content-Length and Transfer-Encoding headers could be auto-generated.

Packaging

Release artifacts are now built from an explicit manifest: the sdist lists what it includes, and machine state and credential-shaped files (.env*, keys, certificates, virtualenvs, caches, agent directories) are excluded from every artifact. Wheel contents are unchanged from 0.47.1.

Assets 2
Loading