Original release notes
What's Changed
- A
/write root (Linux) or read root (macOS) no longer switches off the denies beneath it by @ronleizrowice-ant in #533 - perf: resolve the global npm root off the event loop by @sosukesuzuki in #550
- linux: a re-applied read-deny tmpfs restores read-only, so the write deny above it wins by @ronleizrowice-ant in #537
- linux: pass an over-long bwrap profile through --args by @ronleizrowice-ant in #504
- macos: deny a path the library computed as a literal, not a pattern by @ronleizrowice-ant in #542
- linux: keep a masked file masked when it is a write path or listed through a symlinked directory by @ronleizrowice-ant in #554
- Linux: pin ancestor directories of deny binds against rename by @ronleizrowice-ant in #514
- linux: a read deny or credential mask on a symlinked allowRead target wins over the carve-out by @ronleizrowice-ant in #555
- config: reject a deny glob written with a trailing separator by @ronleizrowice-ant in #536
- linux: collapse read-deny globs to directories, and mount denies where paths resolve by @ronleizrowice-ant in #503
- linux: throw a typed error when the bubblewrap profile cannot be run by @ronleizrowice-ant in #553
- violations: sanitize forged attribution keys, and give the Linux monitor bwrap's write rules by @ronleizrowice-ant in #535
- linux: refuse at start-up when root lacks CAP_SETFCAP, and correct the capability docs by @ronleizrowice-ant in #534
- fix(build): drop the duplicate normalizePathForSandbox import in sandbox-manager by @dylan-conway in #562
- linux: remove the deny mount point a killed process left on the host by @ronleizrowice-ant in #524
- Default write paths obey a read deny, and interior path spellings are canonicalised by @ronleizrowice-ant in #506
- cli: refuse an unusable control fd or settings file, and keep the fd out of the sandbox by @ronleizrowice-ant in #539
- test(windows): fix five sources of failures in the Windows CI steps by @dylan-conway in #563
- linux: walk a read-deny glob's directories once each, not once per name by @dylan-conway in #564
- ci: run on Bun 1.4.2, and fix two tests it and a Linux timeout exposed by @dylan-conway in #565
- perf(proxy): keep the TLS-terminate upstream connection alive per client connection by @dylan-conway in #561
Full Changelog: v0.0.76...v0.0.77
