Prune 1.6.4

Beta. Becomes stable once it meets the stability criteria. For everyday use, prefer the latest stable version.

Security fixes found by a penetration test of Prune. Folder protection could be bypassed by writing a path in a different case, and the Shredder could destroy a copy of a file outside the folder you chose. Update if you use Prune.

Install

1. Download Prune-1.6.4.dmg (under Assets) and drag Prune to Applications.
2. On first launch, allow it in System Settings ▸ Privacy & Security ▸ Open Anyway, or in Terminal:
   xattr -dr com.apple.quarantine /Applications/Prune.app
3. Follow the Full Disk Access assistant.

Verify the file: shasum -a 256 -c SHA256SUMS in the folder where you downloaded both files.

macOS 14 or later · Apple silicon and Intel. The interface follows the system language (English or Portuguese).

Fixed

• Folder protection: a path written in another case (such as ~/documents or /SYSTEM) is now recognised as the protected folder it points to. Before, it could get past the list. The same goes for the folders you ignore in Settings.
• Removing as administrator: if a folder is swapped for a link between the check and the removal, Prune now refuses to delete, instead of deleting where the link points.
• Shredder: a file with other hard links (copies that share the same data, as in pnpm's node_modules) is no longer overwritten. Only its name in the chosen folder is deleted, and the other copies keep their contents.
• Uninstaller: an app with a malformed identifier can no longer preselect other apps' files. Leftovers now match the app's identifier exactly.
• Updates: download and "What's new" links are only opened when they are secure web addresses (https). A link to a local file or to another app is ignored.

Changed

• Every check now runs penetration tests in an isolated environment, with no network, that can only write in its own temporary folder.

Full history in the CHANGELOG.