This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryUpdates Security Fixes, Bug Fixes, and CWE-88 across a mixed release.
Full changelog
Security Update
This release addresses a critical security vulnerability. We strongly recommend updating to this version as soon as possible. User-supplied revision parameters were passed to git without validation, allowing a revision beginning with - to be interpreted as a git command-line option. This could be abused to overwrite pages or disclose files at the repository root (CWE-88).
Thanks to @tonghuaroot for responsibly disclosing this issue and bringing it to our attention.
Security Fixes
- Reject invalid git revisions to prevent argument injection (799aff4).
Features
- Add the possibility to override the roles for the read/write/upload/admin permissions, see #525 (e4a59e8 by @Getslow6, e132d52 by @Getslow6).
- Rework the page index: display the full page path for the list-style index, extend the page index title and align the heading toggle, see #534 #538 (6e52a89 by @ribbal, 1c71047 by @ribbal, 7b26aeb by @ribbal, 3dfb593 by @ribbal, ca36eff, d131be2).
- Enhance the referencing pages plugin, see #527 (cad752b by @ribbal).
Bug Fixes
Dependencies
- Bump pillow from 12.2.0 to 12.3.0, see #536 (d7e26aa by @dependabot).
New Contributors
- @Getslow6 made their first contribution in https://github.com/redimp/otterwiki/pull/531
Security Fixes
- CVE-2026-XXXXX — Reject invalid git revisions to prevent argument injection (CWE-88).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]