Repository navigation

Security/all fixes combined - #24

Open

sunny-se wants to merge 13 commits into

mainfrom

security/all-fixes-combined

Open

Security/all fixes combined#24
sunny-se wants to merge 13 commits into
mainfrom
security/all-fixes-combined

Commits on May 26, 2026
- fix(security): use HTTPS for CLI binary download URL
  
  sunny-se
  and
  claude
  committed
  1483c93
- fix(security): use HTTPS for binary download in shell scripts
  
  sunny-se
  and
  claude
  committed
  ac22720
- fix(security): restrict SPM plugin network scope to .all(ports: [])
  
  sunny-se
  and
  claude
  committed
  54872ac
- fix(security): pin Semgrep CI container image by SHA digest
  
  sunny-se
  and
  claude
  committed
  1f0dc12
- fix(security): remove insecure self-update from cli.sh scripts
  
  sunny-se
  and
  claude
  committed
  ecd1c1a
- fix(security): pin SPM dependency to revision SHA instead of branch
  
  sunny-se
  and
  claude
  committed
  bd124c0
- fix(security): remove insecure self-update from spm.sh scripts
  
  sunny-se
  and
  claude
  committed
  0cfc181
- fix(security): restrict download URL override to HTTPS only
  
  sunny-se
  and
  claude
  committed
  7e92021
- fix(security): sanitize version string to prevent path traversal
  
  sunny-se
  and
  claude
  committed
  95f7990
- fix(security): use atomic temp-dir swap in prepareArtifact
  
  sunny-se
  and
  claude
  committed
  f00a0a3
- fix(security): use isolated temp directory in spm.sh scripts
  
  sunny-se
  and
  claude
  committed
  2d72ba0
- fix(security): add extraction size limit to prevent decompression bomb
  
  sunny-se
  and
  claude
  committed
  05c39bf
- Merge remote-tracking branches 'origin/fix/DEVA11Y-473-https-download-url', 'origin/fix/DEVA11Y-474-https-shell-download', 'origin/fix/DEVA11Y-475-remove-cli-self-update', 'origin/fix/DEVA11Y-476-p…
  sunny-se
  committed
  4e48928

Commits

Commits on May 26, 2026