| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-07-21 | 2.3 kB | |
| v4.2.1 source code.tar.gz | 2026-07-21 | 1.1 MB | |
| v4.2.1 source code.zip | 2026-07-21 | 1.2 MB | |
| Totals: 3 Items | 2.3 MB | 0 | |
4.2.1 (2026-07-21)
Bug Fixes
- add circular symlink detection and depth limit protection (#423) (fd0fcd8)
- add DoS validation for asar archive headers and file entries (#419) (51cd188)
- add header validation for ASAR archives (#421) (00e5293)
- add offset validation to readFileSync to prevent out-of-bounds reads (#420) (97c09cc)
- add path validation to prevent directory traversal attacks (#418) (de0689b)
- compute integrity over transformed bytes when a transform is applied (#450) (8c9be01), closes #277
- constrain extractFile reads to the unpacked directory (#451) (1f4b01d)
- improve symlink validation to prevent directory traversal attacks (#422) (c43f92b)
- replace commander with native Node.js parseArgs (#416) (42b25d0)
- resolve absolute symlink targets correctly when packing (#452) (0087cfa), closes #366