crackerjack 0.33.5__tar.gz → 0.33.7__tar.gz

{crackerjack-0.33.5 → crackerjack-0.33.7}/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.33.7] - 2025-09-14
+
+### Changed
+
+- Update config, core, deps, docs
+
+## [0.33.6] - 2025-09-14
+
+### Changed
+
+- Update config, core, deps, docs
+
 ## [0.33.5] - 2025-09-14
 
 ### Changed

{crackerjack-0.33.5 → crackerjack-0.33.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crackerjack
-Version: 0.33.5
+Version: 0.33.7
 Summary: Crackerjack Python project management tool
 Project-URL: documentation, https://github.com/lesleslie/crackerjack
 Project-URL: homepage, https://github.com/lesleslie/crackerjack

{crackerjack-0.33.5 → crackerjack-0.33.7}/crackerjack/services/secure_subprocess.py

@@ -87,7 +87,7 @@ class SecureSubprocessExecutor:
         self.security_logger = get_security_logger()
 
         self.dangerous_patterns = [
-            r"[;&|`$(){}[\]<>*?~]",
+            r"[;&|`$()[\]<>*?~]",
             r"\.\./",
             r"\$\{.*\}",
             r"`.*`",
@@ -96,6 +96,16 @@ class SecureSubprocessExecutor:
             r"<\s*/",
         ]
 
+        # Git reference patterns that should be allowed despite containing special chars
+        self.allowed_git_patterns = [
+            r"^@\{u\}\.\.HEAD$",  # upstream..HEAD
+            r"^@\{upstream\}\.\.HEAD$",  # upstream..HEAD (long form)
+            r"^HEAD\.\.@\{u\}$",  # HEAD..upstream
+            r"^HEAD\.\.@\{upstream\}$",  # HEAD..upstream (long form)
+            r"^@\{[0-9]+\}$",  # reflog references like @{1}
+            r"^@\{[0-9]+ (minute|hour|day|week|month|year)s? ago\}$",  # time references
+        ]
+
         self.dangerous_env_vars = {
             "LD_PRELOAD",
             "DYLD_INSERT_LIBRARIES",
@@ -316,6 +326,12 @@ class SecureSubprocessExecutor:
         return validated_command, issues
 
     def _has_dangerous_patterns(self, arg: str, index: int, issues: list[str]) -> bool:
+        # First check if this is an allowed git pattern
+        for git_pattern in self.allowed_git_patterns:
+            if re.match(git_pattern, arg):
+                return False  # It's an allowed git pattern, don't flag as dangerous
+
+        # Check for dangerous patterns
         for pattern in self.dangerous_patterns:
             if re.search(pattern, arg):
                 issues.append(

{crackerjack-0.33.5 → crackerjack-0.33.7}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "crackerjack"
-version = "0.33.5"
+version = "0.33.7"
 description = "Crackerjack Python project management tool"
 readme = "README.md"
 authors = [

{crackerjack-0.33.5 → crackerjack-0.33.7}/uv.lock

@@ -398,7 +398,7 @@ wheels = [
 
 [[package]]
 name = "crackerjack"
-version = "0.33.5"
+version = "0.33.7"
 source = { editable = "." }
 dependencies = [
     { name = "aiofiles" },