2.8.6 Release - #3199

Merged

liquidsec merged 8 commits into

security-patches-jun-26-2

Jun 17, 2026

Commits on Jun 17, 2026

Fix arbitrary file write in postman_download via path traversal
liquidsec
committed
36bc208
Bump version to 2.8.6
liquidsec
committed
6d0556b
Defense-in-depth hardening for git and apkpure modules
liquidsec
committed
16fb4dd
Harden gitdumper against CVE-2025-10283 index poisoning
liquidsec
committed
b3df154
Fix postman_download test for tagified workspace name
liquidsec
committed
3c6d881
Harden preload cache pickle and unarchive extraction
liquidsec
committed
4fb38fd
Fix unarchive decompression bomb: pre-check size, cumulative budget
liquidsec
committed
ff75695
Write safe .git/config in sanitize_git_repo for trufflehog compat
liquidsec
committed
2d8e2a6