googleapis/release-please

v17.7.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2d Developer Productivity

✓ No known CVEs patched

This release patches 1 known CVE

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 2d

Upgrade the tmp dependency to version 0.2.6 to eliminate a path traversal vulnerability.

Why it matters: The security issue has severity 90; upgrading tmp resolves it and protects against arbitrary file access.

AI summary

Updates 17.7.0, Bug Fixes, and 2026-05-29 across a mixed release.

Type	Severity	Summary	CVE
Security	Critical	upgrade tmp to 0.2.6 resolves path traversal vulnerability upgrade tmp to 0.2.6 resolves path traversal vulnerability Source: llm_adapter@2026-06-01 Confidence: high	—
Feature	Low	update librarian.yaml for Node support update librarian.yaml for Node support Source: llm_adapter@2026-06-01 Confidence: high	—
Bugfix	Medium	use artifact_id instead of distribution_name_override in librarian.yaml use artifact_id instead of distribution_name_override in librarian.yaml Source: llm_adapter@2026-06-01 Confidence: high	—

Full changelog

upgrade tmp to 0.2.6 to resolve path traversal vulnerability (#2794) (fcec69c)
use artifact_id instead of distribution_name_override in librarian.yaml (#2792) (9acbc83)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track googleapis/release-please

Get notified when new releases ship.

About googleapis/release-please