Skip to content

v1.1.32

Choose a tag to compare

View all tags
@voyvodka voyvodka released this 29 Jun 08:07
v1.1.32
9fc89db
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Pagefind stamp script no longer has a check-then-act file race. The build-time stamper probed each core file with existsSync() and then appended to it by path — a time-of-check/time-of-use window (CWE-367) where the file referenced by the name could change between the two operations. It now opens each file once with an r+ descriptor (fails closed with ENOENT when absent, preserving the stamp-only-if-present behaviour) and appends through that descriptor, so the check and the write target the same handle. CodeQL js/file-system-race alert resolved.
Assets 2
Loading