Security
Please update. This release fixes a security issue in iroh-blobs (updated to 0.103.1). A bug in the provider's event mask meant push requests were accepted even though they were meant to be disabled by default. Any peer able to connect to a provider could write data into its store. The data is content-addressed and verified, so existing blobs could not be modified, but a peer could fill up disk space.
Versions 0.94.0 through 0.103.0 of iroh-blobs are affected. Details: https://www.iroh.computer/blog/iroh-blobs-push-fix
Highlights
- Security: Update
iroh-blobsto 0.103.1 (fixes the push request issue above) - Dependencies: Update
irohto 1.3.0 andrustlsto 0.23.45 - I18n: Use the OS language by default
Bug fixes
- Tray: Show the tray icon on Linux by attaching its menu (#329)
- I18n: Follow the OS language when it changes and match full language codes
- I18n: Keep locale detection working when storage is unavailable
- Docs: Update the Vercel program logo to support dark and light themes
Improvements
- Docs: Simplify the HTML structure of sponsor logos in multiple language READMEs
Dependency updates
New contributors
Welcome and thank you to our new contributors:
- @hiro-nikaitou made their first contribution in #329
- @snowyukitty made their first contribution in #311
- Thanking @rklaehn for letting me know about 0.103.1
Full changelog: v0.7.1...v0.7.2
See the assets below to download and install this version.