github-spec-kit

mirror of https://github.com/github/spec-kit.git synced 2026-08-03 06:26:30 +08:00

Files

Quratulain-bilal 642fa56c0a fix: eliminate TOCTOU race in zip packaging (#3855 )

* fix: eliminate TOCTOU race in zip packaging

Open file once and derive both stat info and content from the same file
descriptor to prevent race conditions where the file is modified between
stat() and read_bytes() calls.

* test: add regression test for TOCTOU stat/read consistency in packager

The old implementation called file_path.stat() then file_path.read_bytes()
as separate syscalls. The fix opens the file once and uses os.fstat() +
fh.read() on the same handle. This test verifies the archived bytes and
mode are consistent with the opened file descriptor.

2026-07-31 12:05:47 -05:00

test_bundle_download_url.py

harden: secure extension and preset archive downloads (#3141 )

2026-07-28 07:52:07 -05:00

test_bundler_adapters.py

fix(bundler): wrap local catalog decode failures (#3902 )

2026-07-31 11:52:29 -05:00

test_bundler_catalog_config.py

fix(bundler): reject a top-level non-mapping bundle-catalogs.yml in _merge_config (#3659 )

2026-07-23 11:15:14 -05:00

test_bundler_conflict.py

feat: add specify bundle command (#3070 )