release: v1.34.0-beta.2 - #1626
Merged
Merged
Conversation
Second beta of the 1.34.0 line, and it is a fix-only one. The beta heading is replaced in place rather than opened above the first, so the section still describes the whole line and gains what the last week added to it. The extension clobber is the one that reached a user. Fixing ext/ftp in the published base image only made it visible how completely a declared custom extension replaced the image's own build of the same name, so ftp lost FTPS again the moment someone had declared it. Builds skip a bundled name now, php:ext add refuses one, and an image built while a declaration was still replacing the better build reads as out of date once so it heals itself. The macOS side covers four defects that shared a root: a guard that never fired let a test run rearrange the developer's own launchd, unit removal left the job registered against a plist it had deleted, three installer checks could not run there at all, and domain add doubled a name that already carried the TLD. The DOMPurify pin moves past the advisory in the copy monaco-editor pulls into the dashboard. The configuration the advisory needs is not one the dashboard uses, so no shipped build was exploitable, but the vulnerable code is out of the bundle. The README needs nothing: this beta adds no surface it describes, and the AI reference was updated by each change as it landed.
The declared worker set landed after the release branch was cut, and it is the half of #1531 the reporter was still seeing, so it belongs in the same beta rather than the next one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second beta of the 1.34.0 line, fix-only. The beta heading is replaced in place rather than opened above the first, so the changelog section still describes the whole line and gains what the last week added to it.
The extension clobber is the one that reached a user. Fixing ext/ftp in the published base image only made it visible how completely a declared custom extension replaced the image's own build of the same name, so ftp lost FTPS again the moment someone had declared it. Builds skip a bundled name now, php:ext add refuses one, and an image built while a declaration was still replacing the better build reads as out of date once so it heals itself.
The macOS side covers four defects that shared a root: a guard that never fired let a test run rearrange the developer's own launchd, unit removal left the job registered against a plist it had deleted, three installer checks could not run there at all, and domain add doubled a name that already carried the TLD.
The DOMPurify pin moves past the advisory in the copy monaco-editor pulls into the dashboard. The configuration the advisory needs is not one the dashboard uses, so no shipped build was exploitable, but the vulnerable code is out of the bundle.
The README needs nothing: this beta adds no surface it describes, and the AI reference was updated by each change as it landed.