Skip to content

omnipkg v2.0.2 - Security Patch & Microsecond Conflict Detection

Choose a tag to compare

View all tags
@1minds3t 1minds3t released this 17 Dec 04:51
· 243 commits to main since this release
v2.0.2
3e1fa47

🚨 Critical Security Update (CVE-2025-68146)

Addressed a TOCTOU race condition in filelock by implementing strict version pinning with environment markers in pyproject.toml. This ensures the security patch is applied on supported Python versions while maintaining installation compatibility for legacy environments:

  • Python 3.10+: Enforced filelock>=3.20.1 (Patched)
  • Python 3.8-3.9: Pinned filelock>=3.13,<3.20.1
  • Python <3.8: Pinned filelock>=3.12,<3.13

⚡ Performance: Redis Pipelining

The Legacy In-Process Loader has been optimized to remove filesystem bottlenecks during conflict detection.

  • New Method: Added _detect_conflicts_via_redis() using Redis pipelining.
  • Optimization: Replaced O(N) filesystem scanning (glob/scandir) with O(1) batched cache lookups.
  • Metric: Reduced conflict detection overhead from ~2.3ms to ~0.09ms.
  • Fallback: Added _detect_conflicts_legacy() for environments without Redis.

🐛 Fixes & Improvements

  • Profiling Silence:
    • Changed enable_profiling default to False.
    • Updated _profile_end() and _aggressive_module_cleanup() to strictly respect the profiling flag.
    • Standard execution is now completely silent.
  • Code Organization:
    • Refactored loader.py logic; moved _activate_bubble and split conflict detection strategies for better readability and maintenance.

Full Changelog: v2.0.1...v2.0.2

Assets 3
Loading