Betterbird's pinned .tar.xz failed on the build seat with "this build seat has no xz to read it": the seat's image is the catalogue's build-agent recipe, which installs git and docker-cli alone, and xz had been added only to cmd/mesh-builder/Dockerfile, which the seat does not build from. The stream is now read with github.com/ulikunitz/xz (vendored), its dictionary capped at xz's own largest preset, and what it unpacks to bounded as before; the xz line in the unused Dockerfile is taken back out.
760 B
760 B
Security Policy
Supported Versions
Currently the last minor version v0.5.x is supported.
Reporting a Vulnerability
You can privately report a vulnerability following this procedure. Alternatively you can create a Github issue at https://github.com/ulikunitz/xz/issues.
In both cases expect a response in at least 7 days.
Security Advisories
All security advisories for this project are published under github.com/ulikunitz/xz/security/advisories.