v1.21.2

This patch release fixes command injection in GitLab inputs and Azure setupRef. GitLab and Azure now validate refs before downloading bootstrap scripts or runtimes.

The installer also prevents executable planting during sfw lookup. All integrations use Socket Firewall Free v1.15.4.

Registry authentication now requires an explicit registry-url input (registryUrl in Azure) or an existing auth entry in .npmrc. Jobs that previously relied on automatic token entries from registry URLs in repository files must update their configuration.

This release also isolates bundle rebuilds from the GitHub App token, expands native operating system test coverage, and updates dependencies.

What's Changed

• chore: upgrade Vite+ to 1.0.0-rc.0 by @fengmk2 in #173
• chore(deps): update pnpm to v12 by @renovate[bot] in #179
• chore(deps): update github actions (major) by @renovate[bot] in #176
• chore(deps): update vite-plus to v1.0.0 by @renovate[bot] in #174
• chore(deps): update dependency @actions/cache to v6.3.0 by @renovate[bot] in #181
• chore(deps): update dependency socketdev/sfw-free to v1.15.4 by @renovate[bot] in #180
• chore(deps): update dependency vite-plus to v1 by @renovate[bot] in #177
• chore(deps): update pnpm package manager by @renovate[bot] in #178
• chore(deps): update vite-plus to v1.1.0 by @renovate[bot] in #182
• fix: prevent Azure setupRef command injection by @fengmk2 in #184
• ci: run the full unit suite on all supported operating systems by @fengmk2 in #185
• fix: isolate bundle rebuilds from the app token by @fengmk2 in #187
• fix: validate refs before CI bootstrap downloads by @fengmk2 in #188
• fix: publish rebuilt bundles from a trusted workflow by @fengmk2 in #189
• fix: require explicit registry input for generated auth by @fengmk2 in #191
• fix: prevent executable planting during sfw lookup by @fengmk2 in #190
• fix: prevent shell injection through GitLab inputs by @fengmk2 in #193

Full Changelog: v1.21.1...v1.21.2