Skip to content

v6.0.5

Choose a tag to compare

View all tags
@alecgibson alecgibson released this 22 Oct 13:28
· 17 commits to main since this release
v6.0.5
b2e86a3
  • GHSA-7vfr-354v-qmm7 — Stop ops that can't be coerced crashing the server
    • Fixes an issue where an op that can't be coerced to a primitive could crash a ShareDB server process
  • GHSA-5h4c-qg46-x477 — Only deliver subscription ops for the subscribed doc
    • Fixes an issue where a pub/sub channel name collision could let a client read ops from a collection it isn't allowed to read
  • GHSA-fv2v-f5r9-496g — Stop subscription streams outliving client disconnect
    • Fixes an issue where a client could leak pub/sub streams that outlive its disconnect, causing unbounded memory growth
  • GHSA-7v53-4cxg-59q3 — Check the shape of ops submitted to projections
    • Fixes an issue where a malformed op submitted to a projection could crash a ShareDB server process
  • GHSA-m8r5-f332-wqwg — Only look up own string keys in extraDbs
    • Fixes an issue where any client could crash a ShareDB server process with the query option db
  • #731 — Bound getOps() by the current version in timestamp fetches
Assets 2
Loading