github EasyIME/PIME v2.0.0-beta4
PIME 2.0.0-beta4 緊急安全性更新釋出 (CVE 漏洞修復與執行環境升級)
on GitHub

pre-release5 hours ago

PIME 2.0.0-beta4 緊急安全性更新釋出 (CVE 漏洞修復與執行環境升級)

⚠️ 重要安全性公告：
本次釋出為重大緊急安全性更新，強烈建議所有使用 PIME 2.0 測試版的使用者儘速升級。本次更新全面修復了內嵌 Python、Node.js 執行環境及第三方相依套件中已知的多項 CVE 安全性漏洞。

PIME 2.0.0-beta4 重點針對內嵌執行環境進行安全升級，修復潛在的遠端代碼執行與記憶體破壞漏洞，並同步整合近期在客戶端通訊架構、安裝程式穩定性與 Windows 11 ARM64 平台的全面改進。

主要更新項目

1. 🚨 緊急安全性更新：修復已知 CVE 漏洞與升級內嵌執行環境

  • 升級內嵌 Python 至 3.15.1：
    • 全面修復 Python 核心直譯器及隨附 OpenSSL / libcrypto 模組的各項已知 CVE 安全漏洞。
    • 升級非同步網路框架 tornado 至 6.6 最新穩定版。
    • 優化 Python 模組搜索路徑與 site 模組載入機制，強化系統安全性。
  • 升級內嵌 Node.js 至 v22.23.4 (22 LTS 安全性維護版)：
    • 修復 Node.js 執行環境核心的多項 CVE 安全性缺陷。
    • (附註：Node.js 自第 23 版起已正式廢棄並停止提供 Windows 32-bit (x86) 二進位檔。為保持 PIME 架構對所有 Windows 系統的最大相容性，持續採用 22 LTS 最新安全更新版。)
  • 前端與相依套件安全更新 (#980)：
    • 升級新酷音設定介面之 jQuery 至 1.14.2 及 Bootstrap 最新版本，移除過期無維護之相依模組。

2. ⚡ 客戶端 RPC 管道重構與非同步防崩潰機制 (#978, #979, #961, #956)

  • 非同步連線與自癒重連 (AsyncConnector)：
    • 將輸入法啟動與後端服務連線握手作業移至背景非同步執行，徹底消除後端冷啟動時造成前端輸入卡頓或逾時斷線的問題。
  • 具名管道 RAII 抽象化 (RpcPipe) 與例外防護：
    • 全面改用 non-throwing JSON 解析與具名管道長度邊界檢查，防止惡意或毀損的 IPC 資料導致宿主程式崩潰。

3. 💻 完善 Windows 11 ARM64 原生支援與安裝程式改進 (#965, #967, #969)

  • Windows 11 ARM64 原生支援：
    • 新增 ARM64X 轉發 DLL，讓原生 ARM64 應用程式（如 Windows Terminal、Edge、Office）能順暢無縫載入 PIME。
  • 安裝程式重構與乾淨升級：
    • 移除舊版 md5dll 與 InstallOrSkip 邏輯，改採原生安全覆寫與明確卸載流程，大幅提升安裝與覆蓋升級的可靠度。

4. 🛠️ 其他錯誤修復與穩定性強化

  • 修復 Surrogate Pair 游標計算 (#938)：解決含有 Emoji 或擴展區漢字時的游標位置偏移異常。
  • 字型設定防護 (#939)：修復候選視窗字型名稱未正確終止 null 字元的問題。
  • 後端行程監護修復 (#943, #953, #963)：優化 Launcher 佇列清理，避免後端意外終止時產生殘留請求積壓。

詳細變更記錄 (Commit Log)

  • Update embedded Python to 3.15.1 and Node.js to 22.23.4 for CVE fixes (#984)
  • Bump version to 2.0.0-beta4 (#984)
  • Update jQuery, Bootstrap. Remove loadingoverlay (#980)
  • Refactor PIMEClient with State enum, AsyncConnector, and auto-reconnection (#978)
  • Refactor PIMEClient to use RpcPipe for pipe I/O and non-throwing JSON (#979)
  • tests: compare the error reply of server.py as JSON (#970)
  • installer: support Windows 11 ARM64 via ARM64X forwarder DLL (#965)
  • installer: replace InstallOrSkip and md5dll with clean uninstall and direct File extraction (#969)
  • Refactor installer logic into reusable macros and fix WOW64 registration (#967)
  • fix(tsf): guard against unhandled json exceptions in PIMETextService (#961)
  • fix(python): make module discovery robust and less hard-coded (#953)
  • refactor(python): move TextServiceManager into Server and load from directory (#963)
  • fix(PIMETextService): enforce maximum buffer size limit on IPC pipe reads (#956)
  • fix(PIMETextService): manage icon cache at ImeModule level via IconCache (#941)
  • fix(PIMELauncher): drop stale requests from dead clients on backend crash (#943)
  • fix(PIMETextService): defer ImeModule initialization out of DllMain (#940)
  • PIMETextService: add explicit null-termination after wcsncpy for candidate font name (#939)
  • fix: map cursor across surrogate pairs (#938)

完整變更對比: v2.0.0-beta3...v2.0.0-beta4

What's Changed

  • fix: map cursor across surrogate pairs (#938) by @dannyward630 in #944
  • fix(PIMETextService): add explicit null-termination after wcsncpy for candidate font name (#939) by @PCMan in #947
  • fix(PIMETextService): defer ImeModule initialization out of DllMain (#940) by @PCMan in #948
  • fix(PIMELauncher): drop stale requests from dead clients on backend crash (#943) by @PCMan in #950
  • fix(PIMETextService): manage icon cache at ImeModule level via IconCache (#941) by @PCMan in #949
  • fix(PIMETextService): unwrap ComPtr for icon cache and fail-fast in build.bat by @PCMan in #958
  • fix(PIMETextService): expose typed imeModule and textService accessors by @PCMan in #959
  • fix(PIMETextService): enforce maximum buffer size limit on IPC pipe reads (#956) by @PCMan in #957
  • refactor(python): move TextServiceManager into Server and load from directory by @PCMan in #963
  • fix(python): make module discovery robust and less hard-coded (#953) by @PCMan in #954
  • fix(tsf): guard against unhandled json exceptions in PIMETextService (#961) by @PCMan in #964
  • Refactor installer logic into reusable macros and fix WOW64 registration by @PCMan in #967
  • installer: replace InstallOrSkip and md5dll with clean uninstall and direct File extraction by @PCMan in #969
  • installer: support Windows 11 ARM64 via ARM64X forwarder DLL by @PCMan in #965
  • tests: compare the error reply of server.py as JSON by @ilwu in #970
  • Refactor PIMEClient to use RpcPipe RAII abstraction by @PCMan in #979
  • Add AsyncConnector and non-blocking background connection by @PCMan in #978
  • Update jQuery, Bootstrap. Remove loadingoverlay by @ottokang in #980
  • Update embedded Python to 3.15.1 and Node.js to 22.23.4 for CVE fixes by @PCMan in #984

New Contributors

Full Changelog: v2.0.0-beta3...v2.0.0-beta4

Check out latest releases or
releases around EasyIME/PIME v2.0.0-beta4

Don't miss a new PIME release

NewReleases is sending notifications on new releases.

Get notifications