8616839cab
CHANGELOG promotion was a manual operator step that was never run, so 463 fragments for work already shipped in <=1.3.1 accumulated in .changeset/. Their notes were already hand-curated into the dated [1.2.0]/[1.3.0]/[1.3.1] CHANGELOG sections (#690 backfill, PR #694). Rendering them now would duplicate and mis-attribute shipped work. Move them to .changeset/archived/ (read non-recursively by all changeset tooling, so never rendered), keeping only the 3 genuinely-unreleased fragments at the top level. Prep for wiring `render` into the release finalize job (#690 follow-up). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
604 B
604 B
type, pr
| type | pr |
|---|---|
| Security | 3587 |
Fixed shell-injection in check.ship-ready — a maliciously-named git branch (e.g. foo;touch${IFS}INJ;bar) could execute arbitrary shell commands when gsd-sdk query check.ship-ready <phase> ran from the repository. sdk/src/query/check-ship-ready.ts interpolated the current branch name into a shell-string git config --get branch.${current_branch}.merge and ran it via execSync. Every subprocess call in the module now uses argv-based execFileSync — the shell is never invoked, branch names are passed as opaque data, and no interpolation site exists.