urun-cli 0.7.5__tar.gz → 0.7.7__tar.gz

{urun_cli-0.7.5 → urun_cli-0.7.7}/CHANGELOG.md

@@ -1,3 +1,24 @@
+## Unreleased
+
+- Security (ENG-570 / pentest urun-cli-01, mirrored in urun-python
+  `urun/core/store/repo.py`): `store.repo(...)` specs parsed from untrusted
+  app source are validated before any git call. The `@<ref>` pin must be a
+  full 40-hex SHA or a plain refname over `[A-Za-z0-9._/-]` (never a leading
+  `-`, never `=`), and the spec head may not start with `-`. A crafted
+  `@--upload-pack=<payload>` tail on a local-path spec made git EXECUTE the
+  payload on the deployer's machine.
+- Security (ENG-570 / pentest urun-cli-02): the `urun dev --attach` loopback
+  token endpoint reflects `Access-Control-Allow-Origin` only for loopback
+  browser origins (any port) in dev mode; a remote page's Origin gets 403
+  and no CORS headers.
+- Security (ENG-570 / pentest urun-cli-03): `urun compat` no longer hands the
+  raw org API key plus the developer's full exported environment to a
+  PATH-resolved `urun-openai`. The compat child env is the frontend scrub
+  allowlist plus the compat credential keys (explicit env wins per key are
+  forwarded through the credentials dict), and the PATH lane is refused
+  while credentials are handed over — explicit `URUN_OPENAI_PROXY_BIN` or
+  the vendored binary only.
+
 ## 0.7.3
 
 - `urun serve --urun-wheel <version>` — pin a deploy to a specific urun wheel

{urun_cli-0.7.5 → urun_cli-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.7.5
+Version: 0.7.7
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli

{urun_cli-0.7.5 → urun_cli-0.7.7}/pyproject.toml

@@ -20,7 +20,7 @@ name = "urun-cli"
 # so every merge remains on the already-published version until this value is
 # advanced. Wiring semantic-release into CI remains separate work; this patch
 # bump is the minimal release unblock (post-v0.6.3 fixes + the Rust feature minor).
-version = "0.7.5"
+version = "0.7.7"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"