Skip to content

Invio v1.0.0.1.49.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 13:23
· 7 commits to main since this release
v1.0.0.1.49.4
a647bb3

Invio v1.0.0.1.49.4 — Provider IVX Windows Security & Compatibility Correction

Frozen parent

Official parent baseline: Invio v1.0.0.1.49.3 Provider IVX Package System V1 replace-ready delta, SHA-256 416a03130f89dfff27204dbc22b32aaabdb05be24fef0fb53b3196ba163d26e7.

Verified defects corrected

  1. Native Windows ZIP-name normalization could hide raw backslashes because the IVX validator inspected ZipInfo.filename; validation now uses ZipInfo.orig_filename before platform normalization.
  2. ProvidersPage called the new provider_logo_path() method unconditionally, breaking the frozen legacy manager-collaborator runtime contract; plugin-logo lookup is now optional/additive.
  3. Raw path aliases such as ./name and dir//name could normalize to the same extraction target; raw canonical spelling is now required.
  4. Windows-unsafe filename components, including NTFS ADS-style : names, trailing dot/space and reserved device names, are rejected before extraction.
  5. Unsupported ZIP compression could escape as raw NotImplementedError; it is now normalized to an IVX validation failure.
  6. logo.png validation previously checked only the PNG signature. IVX now checks PNG chunk structure/CRC, positive dimensions and a 4096px-per-dimension ceiling before materialization; invalid logos remain non-fatal and use the host fallback.
  7. The deterministic IVX builder previously published the final output before final archive validation. It now validates a temporary .ivx first and atomically publishes only after PASS.

Frozen boundaries

No Task state-machine, WorkerManager/QThread, delivery-ledger, database/schema/credential, External Adapter V1, Browser OAuth V1, Easy Onboarding V1, provider Task/send/API behavior, customer/template/report/settings behavior, MSI/WiX implementation, dependency stack or unrelated UI behavior changes.

Verification policy

The owner-supplied Windows v1.49.3 audit is authoritative evidence for the two original failures. v1.49.4 adds platform-independent regression coverage for both boundaries so Linux/CI source-contract runs do not hide them when PySide6 is unavailable. Native Windows and GitHub non-tag CI remain release gates.

Version mapping

  • Application/tag: 1.0.0.1.49.4 / v1.0.0.1.49.4
  • PE: 1.0.1.4904
  • MSI: 1.1.4904
  • Wheel: 1.0.0.1.49.4
  • IVX Format: 1 unchanged

Final source verification

  • Final repository audit: 532 discovered / 513 PASS / 19 SKIPPED / 0 FAIL / 0 ERROR.
  • Targeted corrected IVX tests: 23/23 PASS.
  • Current external provider companion suites: 42/42 PASS.
  • Provider IVX deterministic rebuild comparison: 5/5 byte-identical to the v1.49.3 v1.2.0 artifacts.
  • Wheel build: PASS; P14 wheel audit: 58 source modules / 12 exact runtime resources.
  • Frozen critical architecture comparison: PASS.
  • No TODO/FIXME/fake/demo/mock production endpoint marker was found in the corrected IVX scope/current external provider adapters.

The 19 skipped tests require PySide6, which is unavailable in the Linux delivery container. They are not counted as passes. Native Windows v1.49.4 and non-tag GitHub CI are required before tagging a release.

Assets 6
Loading