Issues

• security: dependency version pinning — loose caret ranges allow silent vulnerability introduction

  security
  KozyOps/semantic-release-clickup#10 · Filter by author SippieCup opened on Mar 7, 2026

• security: CLICKUP_TOKEN sent as raw Authorization header value instead of Bearer scheme

  security
  KozyOps/semantic-release-clickup#9 · Filter by author SippieCup opened on Mar 7, 2026

• security: no HTTP 429 rate-limit handling — silent failures when ClickUp throttles requests

  bugsecurity
  KozyOps/semantic-release-clickup#8 · Filter by author SippieCup opened on Mar 7, 2026

• security: function templates in plugin config allow arbitrary code execution

  bugsecurity
  KozyOps/semantic-release-clickup#7 · Filter by author SippieCup opened on Mar 7, 2026

• security: commit subjects and author names inserted into markdown messages without escaping

  bugsecurity
  KozyOps/semantic-release-clickup#6 · Filter by author SippieCup opened on Mar 7, 2026

• security: messageType validation inconsistency — 'update' is a valid type but fails verifyConditions

  bugsecurity
  KozyOps/semantic-release-clickup#5 · Filter by author SippieCup opened on Mar 7, 2026

• security: no timeout on ClickUp API HTTP requests — CI pipeline can hang indefinitely

  bugsecurity
  KozyOps/semantic-release-clickup#4 · Filter by author SippieCup opened on Mar 7, 2026

• security: sensitive error response body logged verbatim and included in thrown errors

  bugsecurity
  KozyOps/semantic-release-clickup#3 · Filter by author SippieCup opened on Mar 7, 2026

• security: URL injection via unvalidated workspaceId and channelId

  bugsecurity
  KozyOps/semantic-release-clickup#2 · Filter by author SippieCup opened on Mar 7, 2026