ai/danielmiessler.fabric
1
0
Fork 0
mirror of https://github.com/danielmiessler/fabric.git synced 2026-09-09 23:26:34 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

chore(release): Update version to v1.4.461

Browse source
This commit is contained in:
github-actions[bot] 2026-07-28 14:40:46 +00:00
parent 0dbf9cb0ec
commit d49a61a32e
5 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
CHANGELOG.md
View file

@ -1,5 +1,11 @@
# Changelog
## v1.4.461 (2026-07-28)
### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection
- **Fix:** Shell-escape extension values to prevent command injection in the extension executor, which previously ran commands via `sh -c` with unescaped, user-controlled values interpolated into the command string. All user-controlled values are now wrapped in single quotes with embedded-single-quote escaping prior to interpolation, ensuring the shell treats them as literal arguments. A regression test (`ShellInjectionBlocked`) has been added to verify that malicious input (e.g., `hello; touch /marker`) does not execute unintended shell commands.
## v1.4.460 (2026-07-24)
### PR [#2166](https://github.com/danielmiessler/Fabric/pull/2166) by [ksylvan](https://github.com/ksylvan): feat: add Claude Opus 5 support and refresh dependencies

2
cmd/fabric/version.go
View file

@ -1,3 +1,3 @@
package main
var version = "v1.4.460"
var version = "v1.4.461"

BIN
cmd/generate_changelog/changelog.db
View file

Binary file not shown.

3
cmd/generate_changelog/incoming/2152.txt
View file

@ -1,3 +0,0 @@
### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection
- **Fix:** Shell-escape extension values to prevent command injection in the extension executor, which previously ran commands via `sh -c` with unescaped, user-controlled values interpolated into the command string. All user-controlled values are now wrapped in single quotes with embedded-single-quote escaping prior to interpolation, ensuring the shell treats them as literal arguments. A regression test (`ShellInjectionBlocked`) has been added to verify that malicious input (e.g., `hello; touch /marker`) does not execute unintended shell commands.

2
nix/pkgs/fabric/version.nix
View file

@ -1 +1 @@
"1.4.460"
"1.4.461"