Skip to content

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented Mar 17, 2025

Version Updates

Merging this PR will release new versions of the following packages based on your change files.

api-example

[2.0.24]

Dependencies

api-example-js

[2.0.20]

Dependencies

deep-link-example-js

[2.2.1]

Dependencies

autostart

[2.3.0]

autostart-js

[2.3.0]

deep-link

[2.2.1]

bug

deep-link-js

[2.2.1]

bug

fs

[2.2.1]

bug

fs-js

[2.2.1]

bug

dialog

[2.2.1]

Dependencies

dialog-js

[2.2.1]

Dependencies

http

[2.4.3]

Dependencies

http-js

[2.4.3]

Dependencies

persisted-scope

[2.2.1]

Dependencies

process

[2.2.1]

process-js

[2.2.1]

shell

[2.2.1]

bug

  • 9cf0390 Apply the default open validation regex ^((mailto:\w+)|(tel:\w+)|(https?://\w+)).+ when the open configuration is not set, preventing unchecked input from being used in this scenario (previously the plugin would skip validation when it should disable all calls). This keeps backwards compatibility while still fixing this vulnerability.
    The scope is no longer validated for Rust calls via ShellExt::shell() so if you need to block JavaScript from calling the API you can simply set tauri.conf.json > plugins > shell > open to false.

shell-js

[2.2.1]

bug

  • 9cf0390 Apply the default open validation regex ^((mailto:\w+)|(tel:\w+)|(https?://\w+)).+ when the open configuration is not set, preventing unchecked input from being used in this scenario (previously the plugin would skip validation when it should disable all calls). This keeps backwards compatibility while still fixing this vulnerability.
    The scope is no longer validated for Rust calls via ShellExt::shell() so if you need to block JavaScript from calling the API you can simply set tauri.conf.json > plugins > shell > open to false.

single-instance

[2.2.3]

Dependencies

updater

[2.7.0]

bug

updater-js

[2.7.0]

bug

window-state

[2.2.2]

window-state-js

[2.2.2]

@github-actions github-actions bot requested a review from a team as a code owner March 17, 2025 10:27
@github-actions github-actions bot added the version updates PRs that will publish new plugin versions label Mar 17, 2025
@github-actions github-actions bot force-pushed the ci/release-v2 branch 9 times, most recently from 6f88343 to 566ca87 Compare March 24, 2025 01:45
@github-actions github-actions bot force-pushed the ci/release-v2 branch 10 times, most recently from d87ceb0 to f13775d Compare April 1, 2025 00:59
@github-actions github-actions bot force-pushed the ci/release-v2 branch 2 times, most recently from f88ed3d to 0ffe385 Compare April 2, 2025 01:37
Copy link
Contributor Author

github-actions bot commented Apr 2, 2025

Package Changes Through 2c0f417

There are 2 changes which include shell with patch, shell-js with patch

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package current next
api-example 2.0.24 2.0.25
api-example-js 2.0.20 2.0.21
shell 2.2.0 2.2.1
shell-js 2.2.0 2.2.1

Add another change file through the GitHub UI by following this link.


Read about change files or the docs at github.com/jbolda/covector

@lucasfernog lucasfernog merged commit 8b39aef into v2 Apr 2, 2025
2 checks passed
@lucasfernog lucasfernog deleted the ci/release-v2 branch April 2, 2025 03:31
gezihuzi pushed a commit to Hypobenthos/plugins-workspace that referenced this pull request Jun 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
version updates PRs that will publish new plugin versions
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant