v1.2.1

conflibot v1.2.1

Security patch for the v1 line. Backports the command-injection fix from v2 onto v1.2.0, with no other behavior changes.

Security

• git commands no longer pass through a shell. Under pull_request_target, a pull request whose head branch name contains shell metacharacters could previously execute arbitrary commands with the job's write-scoped token. All git invocations now use argument arrays via execFile/spawn. (GHSA-2qvg-qr73-mqxp)

Notes

• This is a drop-in upgrade for v1 users — no runner or configuration changes required.
• v2 contains the same fix plus accurate merge-tree detection and fork-PR support; see https://github.com/wktk/conflibot/releases/tag/v2.0.0.

🤖 Generated with Claude Code