diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 03ee177..3c1cdf3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,9 +3,11 @@ on: push: branches: - main + - "v*.x" pull_request: schedule: - cron: '30 3 * * 2' + workflow_dispatch: jobs: test: diff --git a/CHANGELOG.md b/CHANGELOG.md index 04fdd4d..2c8af3a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,21 @@ Possible log types: - `[docs]` for documentation changes. - `[chore]` for maintenance work. +### [v1.7.2][v1.7.2] (2025-03-18) + +This patch release updates the `zip` dependency to mitigate a potential security +vulnerability. A successful attack against tealdeer users would require +manipulation of the tldr pages archive downloaded during an update. As the +archive is downloaded from a trusted source (the tldr-pages organization), it +seems very unlikely that running a version of tealdeer prior to 1.7.2 poses a +security risk. Nevertheless, it cannot hurt to rule out any chance of an attack +by updating tealdeer to version 1.7.2. + +For more details, please see https://github.com/advisories/GHSA-94vh-gphv-8pm8. + +- [security] Require `zip >= 2.3.0` +- [chore] Run CI on backport branches and on dispatch + ### [v1.7.1][v1.7.1] (2024-11-14) This patch release updates the `yansi` dependency to version 1, so that the @@ -457,6 +472,7 @@ Thanks! [v1.6.1]: https://github.com/tealdeer-rs/tealdeer/compare/v1.6.0...v1.6.1 [v1.7.0]: https://github.com/tealdeer-rs/tealdeer/compare/v1.6.1...v1.7.0 [v1.7.1]: https://github.com/tealdeer-rs/tealdeer/compare/v1.7.0...v1.7.1 +[v1.7.2]: https://github.com/tealdeer-rs/tealdeer/compare/v1.7.1...v1.7.2 [i34]: https://github.com/tealdeer-rs/tealdeer/issues/34 [i43]: https://github.com/tealdeer-rs/tealdeer/issues/43 diff --git a/Cargo.lock b/Cargo.lock index 317311a..e8db079 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -86,9 +86,9 @@ dependencies = [ [[package]] name = "arbitrary" -version = "1.3.2" +version = "1.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110" +checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223" dependencies = [ "derive_arbitrary", ] @@ -260,9 +260,9 @@ dependencies = [ [[package]] name = "crossbeam-utils" -version = "0.8.20" +version = "0.8.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80" +checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" [[package]] name = "der" @@ -276,9 +276,9 @@ dependencies = [ [[package]] name = "derive_arbitrary" -version = "1.3.2" +version = "1.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "67e77553c4162a157adbf834ebae5b415acbecbeafc7a74b0e886657506a7611" +checksum = "30542c1ad912e0e3d22a1935c290e12e8a29d704a420177a31faad4a601a0800" dependencies = [ "proc-macro2", "quote", @@ -516,7 +516,7 @@ dependencies = [ "combine", "jni-sys", "log", - "thiserror", + "thiserror 1.0.64", "walkdir", ] @@ -531,7 +531,7 @@ dependencies = [ "combine", "jni-sys", "log", - "thiserror", + "thiserror 1.0.64", "walkdir", "windows-sys 0.45.0", ] @@ -762,9 +762,9 @@ dependencies = [ [[package]] name = "proc-macro2" -version = "1.0.86" +version = "1.0.94" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77" +checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84" dependencies = [ "unicode-ident", ] @@ -1040,9 +1040,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" [[package]] name = "syn" -version = "2.0.79" +version = "2.0.100" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590" +checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0" dependencies = [ "proc-macro2", "quote", @@ -1051,7 +1051,7 @@ dependencies = [ [[package]] name = "tealdeer" -version = "1.7.1" +version = "1.7.2" dependencies = [ "anyhow", "app_dirs2", @@ -1108,7 +1108,16 @@ version = "1.0.64" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84" dependencies = [ - "thiserror-impl", + "thiserror-impl 1.0.64", +] + +[[package]] +name = "thiserror" +version = "2.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708" +dependencies = [ + "thiserror-impl 2.0.12", ] [[package]] @@ -1122,6 +1131,17 @@ dependencies = [ "syn", ] +[[package]] +name = "thiserror-impl" +version = "2.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "toml" version = "0.8.19" @@ -1471,9 +1491,9 @@ checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde" [[package]] name = "zip" -version = "2.2.0" +version = "2.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc5e4288ea4057ae23afc69a4472434a87a2495cafce6632fd1c4ec9f5cf3494" +checksum = "938cc23ac49778ac8340e366ddc422b2227ea176edb447e23fc0627608dddadd" dependencies = [ "arbitrary", "crc32fast", @@ -1482,7 +1502,7 @@ dependencies = [ "flate2", "indexmap", "memchr", - "thiserror", + "thiserror 2.0.12", "zopfli", ] diff --git a/Cargo.toml b/Cargo.toml index 4787d64..bbd31c7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -10,7 +10,7 @@ name = "tealdeer" readme = "README.md" repository = "https://github.com/tealdeer-rs/tealdeer/" documentation = "https://tealdeer-rs.github.io/tealdeer/" -version = "1.7.1" +version = "1.7.2" include = ["/src/**/*", "/tests/**/*", "/Cargo.toml", "/README.md", "/LICENSE-*", "/screenshot.png", "completion/*"] rust-version = "1.75" edition = "2021" @@ -31,7 +31,7 @@ ureq = { version = "3.0.8", default-features = false, features = ["gzip"] } toml = "0.8.19" walkdir = "2.0.1" yansi = "1" -zip = { version = "2.1.6", default-features = false, features = ["deflate"] } +zip = { version = "2.3.0", default-features = false, features = ["deflate"] } [target.'cfg(not(windows))'.dependencies] pager = "0.16" diff --git a/docs/src/usage.txt b/docs/src/usage.txt index 846ff8c..a4a5fcb 100644 --- a/docs/src/usage.txt +++ b/docs/src/usage.txt @@ -1,4 +1,4 @@ -tealdeer 1.7.1: A fast TLDR client +tealdeer 1.7.2: A fast TLDR client Danilo Bargen , Niklas Mohrin Usage: tldr [OPTIONS] [COMMAND]...