Repository navigation
chore(release): v0.2.1 to main - #86
Merged
Merged
Conversation
… conflict repair
* fix: keep keychain secrets out of process arguments `security add-generic-password` received the secret as `-w <value>`, so it sat in the process argument list while the command ran and any local process could read it with `ps` (GHSA-h6g4-mq8c-5chp). The value now reaches `security` on stdin: the command is fed to `security -i` and carries the secret as `-X <hex>`. The documented prompt form (`-w` last, value on stdin) is not used because `security` reads it through a 128-byte buffer and silently stores only that prefix, which real n8n API keys exceed. find, delete and list behaviour is unchanged. * fix: count keychain input line in bytes `security -i` reads a line into a fixed 4096-byte buffer, but the guard measured the command with `String#length`, which counts UTF-16 code units. A multi-byte account name (a raw user URL) is longer in bytes than that, so a line the buffer cannot hold still passed the check and was split in two, which can echo the hex-encoded secret back in the thrown error message. Measure `Buffer.byteLength(command + '\n', 'utf8')` against a conservative `MAX_LINE_BYTES = 4000`, and report the rejected value's UTF-8 byte count in the message (it said "bytes" but printed code units). Tests cover a multi-byte account refused before spawn, the exact ASCII byte boundary, and the byte-count message. The macOS e2e adds a round-trip for an account holding a double quote, a backslash and a space, plus a real `security -i` non-zero-on-failure check. Refs GHSA-h6g4-mq8c-5chp.
…dex/gpt-6-sol (parked)
* chore(release): v0.2.1 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: name auth login in 0.2.1 security note --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.2.1: merges
developintomain..xezar/campaigns/20260923-n8n-2-40/decisions.md, 2026-09-25.After merge: signed tag
v0.2.1on main, GitHub Release, the owner approves the protectedreleaseenvironment, then the advisory is published with fixed version 0.2.1.