This is a security release addressing 2 known issues:
- (GHSA-j2qc-j92x-qqhj) The mechanism used by Briefcase to construct cache filenames has been strengthened to remove the ability for a malicious server to write arbitrary content into a Windows file system. This problem is known to exist in all versions of Briefcase from v0.3.0 to v0.4.6; however, the download hashing added in v0.4.5 makes the bug extremely difficult for an attacker to exploit. Full details can be found in GitHub Security Advisory GHSA-j2qc-j92x-qqhj; a CVE has been requested. (#3110)
- The minimum version of
piprequired by Briefcase has been bumped to 26.2.2 to ensure that the eMudhra Intermediate CA is not in use. (#3111)