From ba6feced6281ef41aa7b9cc3219ef09f96521730 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:30:08 +0000
Subject: [PATCH] chore(release): Update version to v1.4.462

---
 CHANGELOG.md                             |   7 +++++++
 cmd/fabric/version.go                    |   2 +-
 cmd/generate_changelog/changelog.db      | Bin 4542464 -> 4550656 bytes
 cmd/generate_changelog/incoming/2167.txt |   4 ----
 nix/pkgs/fabric/version.nix              |   2 +-
 5 files changed, 9 insertions(+), 6 deletions(-)
 delete mode 100644 cmd/generate_changelog/incoming/2167.txt

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5c4c745..400dc10f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## v1.4.462 (2026-07-28)
+
+### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup
+
+- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.
+- New translations for the "invalid pattern" user-facing string.
+
 ## v1.4.461 (2026-07-28)
 
 ### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection
diff --git a/cmd/fabric/version.go b/cmd/fabric/version.go
index 0f595fc8..6a3a0a03 100644
--- a/cmd/fabric/version.go
+++ b/cmd/fabric/version.go
@@ -1,3 +1,3 @@
 package main
 
-var version = "v1.4.461"
+var version = "v1.4.462"
diff --git a/cmd/generate_changelog/changelog.db b/cmd/generate_changelog/changelog.db
index 2105f7b8cc3b63c7b6e90b36eb83f1f4f32dbd3d..69aec75961343b2361c77d4cf8f5d305ff154a22 100644
GIT binary patch
delta 6710
zcmcgwYj7LY72aJ*k-WC0yzG#deXWqhc5Hc9kJZCTY-0sNpov0WO>ASYc2~(_d8J6Q
z9rGB)=3$0`)FCz(m*J6VC#19t0k>U-P)Nvh0t_vI&Xga8me=$}O9RY6Ng?#?%Ce=5
z6Es8GA77$f@1A?^Ip6utxx4?dF>3$2W7NoE(_Vrw?l_2=$h}W@v6XAvjmtf*D4$Gq
z#uJ^%0Yz{!POhHu);oP$Sx>;}4!GG})AtbEb1?zN7g+9LhuRLkUb%F>bA~@ZgO1zC
zwnNW1w36-5Fh*qgQ_+dV+R76pq321e=)}aUn?E<3;m)R^iTM+!cZO|vNuQy{NDxFD
z{$!xC&P@COTqS%sm^L&_JS$&6%W|z{3k7d%pD2lsP?TlM#3PAcm}bG98%FvjcJ4d+
zma(*nxDJ~_WG7YpAQnTUPkkgro}*n3Lx+KtI1lWN<HK%`&&{wd*3CNojMFcASf}9f
zdwk(A$4MSy{C@3meDbO0YW1@=a!#sz6In%2Ur;aGg48&56V*tSkndP`;w#RO_gYH-
zW4+tD(^`A5r3{A-Q%3dl8PZ!y-iW_>hwQBNMg)%YaS>h+xUkRbc6ofP<QF9`%ZU>2
z@$oJ<<8-ma_!tfxuc%Xh{zo#jnG9kRLse0hx9|#vlGTF@b+?H;sV?HEmnetZ<@Sa>
zLc}9@-HhmU3oa+)_WHvv7cWFyl2?#8ffL=t_#u58X!NRT)#<0+JYw8LoFc}qH!Lc#
zy<x32|HJ$%^8xxvT=y=u&m57wl8fUp`J%skavSeb&lQmkc=o?%S96dH%^2qnvk`%f
zKnTUKGt4@9mmso|1e+8^mhpLcr-y@G65|hKLb$KBTD5#ceHAp^KzxeLjNwNV@#(>q
z1^N>BG-GJMe_LEsZ6HSPQ>$3RyKCpz%81S2X6b7sTT36d*3K%&bK{0_vMl?OdOB{{
zYI1<D5VnXb;*l89@8ejW=fm2*BYtm~@rh1J5V?q-7$4OgIr!TZ)#~0p!;dW*!EPL0
zm^J{60F$~fJ?pQ>is5#M3=y`VtqfZj^TVbzT%DRuDr4SgHD)&T+9J*2H*s0o;Kr*y
zShaHa(Izv%0w@B|fMP%ipcG&Q*Z{Kua{zMz^8oV!Wq@+P0>Bl3g@8qX#egM%rRt+i
z72%Mv_(7rxn?@>{D0&kPj#M<Oca2oMQq-V%R4B2@k^Q)8Gg+rT@xzK8rps*diHcn&
zGK5XXDrCy~XRI8n@XfMpD3*%@(=j|&F;+_6htuD`vKrs{LPf+;V0Dlqx9gEl-|DYc
zTVAX<h5kP){j1_c$XN6e(TYvYmA&&VM~g(_)8fxd6<g4{)3RaKo8|-Rf#%9Z7F}OF
z1r{bbGML%TStt&}wUy^*{jb;9S$V$PXnK~o9-HEo{gm-5d~3YYu09s8Y&Ytz7h2ck
z$Q`=tXZDm;t2=rtpP(<h+2I{`R;oMhL{DzWNX8kI1j)cRpFyl90vV0Pr_Ug!wm=Oa
zM~2j@H_!(!Tt<V#RR^m8cEB>gm4M}d6@Zm$)xqiy4v?RzCRB3^NtHf`_gB?K)sL%c
zPSE5(@l$m*pPJm9(|T(7NPP{U7O)CX2dD=)01W^Jzyh2A7r+hh062hGJyP$x@g?K?
z<W~e<GTX?gzO%k|lBQSC3usHxmqmZaqo4R1)ZcvK3z{k74|v{}zPGNk8kQRRSclsI
z%Y#JcUykKpj^<w;%D=pS*mKSY@T;D4f!DW@oN5X+N)&DTo$XcIN!zowrykhSc(eNP
z4ULb|<Z|^uN8@s;#?lXqS`3sy`!SaNF`E5xDEs67;kP>*0jmLP0BZqFfM!4o;41a)
z&erPL2F5TOo8zrJ#%`o(b<T+KD3xxx>#)(-LAeSgw55NB*#(RkG$XD8<!RbT+Uc7b
zkiZJ1S<%{RA+2iKO1=?NGg6?o@a~IQAv7z6Hj0ZFc`R-0z=uB!)((%STGjDXu)F&T
zn)sTqZMGgNxrct6t~a$BN2x*bXT;YS^6}o5!CDyZ=#Hh^RyH(Q3J*n=qr#q8LJA;R
z5n?^EvKu*Brwbq67UU-5%(4O2yNZEvl$p`x!O+meyyA|fgO!=}3yh*WyM9F8S1q$X
zr6zz<30_G?`ILm>d@8j>N+_MO(#J<-u~XrDB=9j6Lwq!fSO%l*tLNjt9A9%~RGXqT
zLNHvw?Yo4dcUXre=7OVlEm*on3sj+r%5gM+-#gG;9+VZ`LGTahenn%k?%p`67NW7F
zltjy%jNe^D(;?VI_L(FSVoHja6)nVehr^Cr#@Ko3q`=1|l-iToF+7~4ML8h}saRqF
z@rsBN5-%b?5tbn~a4RB5VSzrG*MC8j_Bb}gWW|B5>E#pfpeRc4Z;I9|rebjvi=f?7
z>gq(SCwNsO(!z|orGc#XoxAeFn|V7EVwz=9G$!y-DYIrHN=eBS5_oNcLaa|p=!pQ%
z^u!b`ad0QeM^PW2ka;DQbl{UeUAYi9edaI1C9k$F+_*`UmFp6GG$zX3@LzL0mPo~-
zyaE<e4pHjMNQ9@J<+NP7eE~OjiCn6q9|q%%w88ueQTht~xcL=zPM7Jpx#`Yb54T#D
zHkB^CXN@bHw|w!@&srJFZBCZ+b}U=A425n$ZOef8m>dhRl#|70k2vc}^#rs{I*vd2
zqN?1M-35>pc$=X^dS*J%bUmuA-69FS2{|=@u7<~JYtdB@)NaU;mb#p<0aJLPI|&TW
z=H?R2LhtV%&3UY$M^DKVySf~XE=W;t6jn({eR8Zf867~<6xHzN<@U1lrMT6l(QJxb
zU5$uGyLEo;;gcvVNy-$_bm~qLt!s*DU3Cz;X|{ENDXkE4i<y-0Y){erv|i2mRMTD-
zbLpnU`U|2Q1bm~^KcymaOi7|hETQ{opJaMAZg$k0loIuL!Ejw^nS;*fh<^4~AFo}v
zb2(iKXBN_AAWR00VqY2;j17$R+lay9dsi)PDcjrB@lee5ZB)2G8GvwGdV6}Ho;8l-
zgbm#UwG8CYT}$@H<54+7l^hw#$O9x)7sCrO6-50q@JflHB(KORImxFW3J}m}G}f;v
zk0w`16qUOr1T<-oQbI$VPbT}tE|7~!j^O%V8yDckH5{ErUCC4e-b*@KGwPMB)-2TN
z3RcrK$qGJo5gNd4_*+6s^@6Zzl#mh$$cNn1BZ)G|d~^Wz-=b^QOdOHYUDG7WDt|s#
zQ1v=xcT`U9L93uC<fXo5+V)nEu4}R~*cpP-+nN<D*tf20nxbg|^5hg{U+tur(R6E$
zvO8!RGN{=^aS$*qhiwSI_i~^DAA8MZNjtRq)1nHI&ZGlK+4ZeH=w>?5##o{Ubab+0
zCKFZ-8P&?VM(-lB(yOUE>W?M5vv28n)mLlQ>z`K!`u9i)X)^lL!Ov|&7u1Bln4QLh
z4eT;}>?5BIH~(_Q96a}-;P$jPze1eefO~Q%;QV4Z;&$^Q8}YFqsEpwDL|8$P!VG-#
zVMQP3;=+C@(sqk|%la03z+PzIwb$9dCnb~oZpj`n*{5o3eL))8uCyzV=$yjI*?2oN
z;P#7l;CAJ5wBUB7pdQ?or;5^~ux7~Ku6(y9jKA>(R^Zov-`bGQ_AQ9%x*lGRLK-gC
zh~beS)FwPJ-IBGBlzL0v1%D0k2?;v9J<w(s-F_av3b~vT<MF^JD<6EWk_0cqxSRsZ
zx!sb;`6OQQr|liL)n)Tv=zy4;e=YqpPl*@wmAoMlgixv11OnG=UtNrSAGfTdv)^19
z4xc=~dfv_gzgOmNps>RRK6$RJ9G_huET&+fe&ZwWwsdxFeWbo1lm$m6Cz6GpohBoR
zkN%{xBrPOBd{Zcy9ZVpyx~e4Pa4(FVnof%lI2gjS<G9vHwR);Yt(kYjF=#ScJx#rn
zZL=U-xnoW4A`Z<!Fy<9{dw@Pjxmc&ZP?VryX&Qj{TGw5h)<2hPv%dF&@D-Mmh(9-v
zg`QuhiHKJ}F_*Rg{d;@DQUafUCwRrY0sX{;>f3vP_7YrhUOZT`ZoQcEX+OVe3Qk+c
zZ5{cts}CmHL_(FGBdpJro>S+XT@o!((TH(~+&I`cG*J!*!T!uatkCUc=j6$QVBYSm
z+1;(pZ0zZ6!4;F|!kj^R#&h9N%g{s_9Jg*KGwu|+>#RFsOh^XM3~Wv3Q*TDPYEAh&
gkrmz##%89feR`_A2v;3gi_?nCu~cX4C5|%x1>4s*RR910

delta 1708
zcmbu<TTB#J7y#foXJ&S0?+XHQ(Vba!VZg<mT`s$@Eer0pY0=<9C3NvZwFOHxx(Zfp
z4Ny~Ev4Ts0p3+9tv=w7wrEZ&JD)E93)WlTur7vPgG}^>O(I&P*Li>wN=tCcBOy+y|
z&z$rB=bZU7ZR5ST?PxEKW$+sqhO6$9{b<AY@3^FrTFzdOw`pBdb6sRxUDK}3@48iY
zVXo@Qb$eI3@{9A}@zl<a$uO3$7Uvff+Y4NK!rj-T`AM$-czs4bXGY=fA!h*9o>4hj
zyrmt<fXXZ4hR_fqpGfSMxTmUJAQmBCh>wKVo5}qQZKlBVbTACFiagpSIrPk-tq^#Z
zuxnUy>1w*dGCeoqXB(Gm#5cq+hHO=FLnMarhNgJ`wjX)TrurtiadSMp^Te;5{tKp@
z@F7%38bZj6&DUvv2u<oZqn~jS|9a#kmrj=|^!HULp*g7n*%<r>{@EPFefR_H!v-`)
z(nrxjo$0RescF9{Y|7~>OD3UXn4=@3$YVqu<gYPEK70={`OjIi=nuD0s1gMTuVNeN
zm$67x6|Y16G^XNq9!=2nLOhJgz-jCxww|R~)Ln#c9Oo*S%S`WbHk~tHH|3Be5l1R1
z9mfsYe0M{=r#`Q69YGh0QvRttj(^gkwZ!tL1@7X|R&wei$ssVksn2g{XF#FieLNLp
zE0K)|D*H8Z6IU!Lb!IggQCTMmjLER{;4*4+vEwBPaJ_HA1~e(gtA>@v!?1(I2;0X7
z&B?RJjj${EZly7Yo2k<EOQu4%e#m|!&cxBQRu*u8r)jO4-v$M9GE;#<3^Ay}VeJ_D
z4z)sbc{ZOaRG2s@yq3t#7DZs%S3@vFrawd3cwd-g-d^m89`Or61X`d2dSC!XU;<`f
z0SO=x%mGOt8Ki)@AQhy6bdUk&f%)`^-?~1;=~gf$gpXPM<n@@f6q_jB7qec`KI<DN
znb?687IoN(tr9ut$uF%n{0l8OX|3ha3c?Rs8%bo)>J?3Q#d3Y4zIgT)2CcnDG(=k8
zUZjw{=dBH7*k6`K9;8VEY296<(6S5G%ks<Scxb&C;=~ioQo@%?+mp2KF^~06jGN6t
zQ&=q5+z>jsDcV^orHh<)7>@1y7Apce@Nnisw@yGiv2RM#nwQHEmZnoUZi-n(_=vQF
zv_zx@SWxNFh_ssH__I*9?4AwEc9hSQ9eqDpp*7p3le!mN6s_4S(VD&Tsq*LTKPoqo
z-J`PW-_1-$MrHN$Te5;%5~=OFeEa<Wn;W%t*}wv@5G(?AkO{J=txLJxi5^p4&i)vY
zJ+|yk*vQfcw(N^K^pu=-WIyKJ9+$BtdOSB9<bcJ%0dm0--~=jg0XN74`Jez40uMc&
z>s>p{jiD)q%(HMR^-g$KBhvrK3;(e;yOT_}1w=ae$U9fSD3i`<4=g~@f=MqZq6L%1
z*Q$|=@*!V6CQqt-pV9|az9TwRMLXB{?3iq+c4&#A+L6HvUZ!(l^k$t8yaHYYCBP3#
zK^a&|Z`K7A3%i(WBtj%mLlb0;p3{`=JKD;vA;<0nbE19C0ovCb+_*7O;CdKyrK#I+
pKzCD@%LllgXVY6a+H)ru@rhVBz!<OS257>#<|`c?$ayVn{~PpEFPQ)U

diff --git a/cmd/generate_changelog/incoming/2167.txt b/cmd/generate_changelog/incoming/2167.txt
deleted file mode 100644
index 0a5760cb..00000000
--- a/cmd/generate_changelog/incoming/2167.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup
-
-- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.
-- New translations for the "invalid pattern" user-facing string.
diff --git a/nix/pkgs/fabric/version.nix b/nix/pkgs/fabric/version.nix
index a86de663..9a91820f 100644
--- a/nix/pkgs/fabric/version.nix
+++ b/nix/pkgs/fabric/version.nix
@@ -1 +1 @@
-"1.4.461"
+"1.4.462"