Repository navigation

fix(alias): reject path-traversing dependency aliases — fixes #2900 - #2901

Merged

Daniel Meppiel (danielmeppiel) merged 17 commits into

microsoft:mainfrom

Danvs60:fix/alias-poisoning

Sep 17, 2026

Merged

fix(alias): reject path-traversing dependency aliases — fixes #2900#2901
Daniel Meppiel (danielmeppiel) merged 17 commits into
microsoft:mainfrom
Danvs60:fix/alias-poisoning

Commits on Sep 7, 2026
- fix(alias): reject path-traversing dependency aliases
  Daniel (Danvs60)
  committed
  897e15a
Commits on Sep 8, 2026
Commits on Sep 9, 2026
- fix(alias): preserve placement and current ref replay after install
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  9167a99
- test(cache): exercise stale bare fallback under corrupt receipts
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  c5b4a86
- test(lockfile): declare absent alias in dev dependency fixtures
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  58190d8
- Merge current main into alias recovery candidate
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  d1dd63c
- fix(spec): preserve published alias schema identities
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  5a0d872
Commits on Sep 17, 2026
- Merge current main into PR #2901 for integration qualification
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  806cd27
- fix(alias): clarify compatibility and recovery after main integration
  
  Daniel Meppiel (danielmeppiel)
  and
  Copilot
  committed
  899397a