Pull requests

• fix(security): fail-closed CLI signature verification + https/browserstack.com redirect allowlist [DEVA11Y-473]

  #46·Crash0v3rrid3 opened Oct 16, 2026Collaborator·

  ·
  2

• chore(deps): bump github/codeql-action/upload-sarif from 2.20.0 to 4.38.3

  #44·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  2

• chore(deps): bump actions/checkout from 3.5.3 to 7.0.1

  #39·dependabot[bot] opened Aug 28, 2026Bot·

  ·
  1

• fix(spm): eliminate TOCTOU races in cache prep and spm.sh cleanup (DEVA11Y-482,483)

  #29·Crash0v3rrid3 opened Jun 17, 2026Collaborator·

  ·

• fix(security): harden self-update with tagged refs + SHA-256 verification [DEVA11Y-478]

  #27·sunny-se opened Jun 9, 2026Collaborator·4 tasks done·

  ·

• refactor(security): make the DEVA11Y-484 extraction guard directly unit-testable

  #26·maunilm opened Jun 2, 2026Collaborator·

  ·
  1

• Security/all fixes combined

  #24·sunny-se opened May 26, 2026Collaborator·

  ·

• fix(security): use isolated temp directory in spm.sh scripts [DEVA11Y-483]

  #23·sunny-se opened May 26, 2026Collaborator·3 tasks·

  ·

• fix(security): add extraction size limit to prevent decompression bomb [DEVA11Y-484]

  #22·sunny-se opened May 26, 2026Collaborator·4 tasks·

  ·

• fix(security): use atomic temp-dir swap for cache updates [DEVA11Y-482]

  #21·sunny-se opened May 26, 2026Collaborator·5 tasks·

  ·

• fix(security): remove insecure self-update from spm.sh scripts [DEVA11Y-478]

  #18·sunny-se opened May 26, 2026Collaborator·

  ·

• fix(security): pin SPM dependency to revision SHA [DEVA11Y-477]

  #17·sunny-se opened May 26, 2026Collaborator·

  ·
  1

• fix(security): remove insecure self-update from cli.sh scripts [DEVA11Y-475]

  #16·sunny-se opened May 26, 2026Collaborator·

  ·
  1