astral-tokio-tar

What's Changed

• Bump taiki-e/install-action from 2.77.1 to 2.77.6 in the github-actions group by @dependabot[bot] in #84
• Bump the github-actions group with 2 updates by @dependabot[bot] in #87
• Remove filetime dependency by @woodruffw in #86
• Reduce parsing differentials and reject ambiguous cases by @zanieb in #95
• Bump version to 0.6.3 by @zanieb in #96
• Update rustix dependency from 0.38 to 1.0 by @musicinmybrain in #97
• Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #89
• Use clear instead of truncate(0) by @zaniebot in #102
• Fix nanosecond conversion on 32-bit Unix by @zaniebot in #101
• Align the release workflow with other Astral projects by @zanieb in #103
• Bump version to 0.6.4 by @github-actions[bot] in #104

New Contributors

• @zanieb made their first contribution in #95
• @musicinmybrain made their first contribution in #97
• @zaniebot made their first contribution in #102
• @github-actions[bot] made their first contribution in #104

Full Changelog: v0.6.2...v0.6.4

What's Changed

• Remove filetime dependency
• Reject mixed PAX and GNU path metadata
• Reject unterminated PAX records
• Reject mixed PAX and GNU link targets
• Trim GNU long names and links at NUL
• Add a restricted local-PAX input mode
• Parse PAX records by declared length
• Apply PAX owner names to entries
• Apply PAX size overrides to entry headers
• Apply Solaris X metadata only on USTAR carriers
• Report truncated TAR payloads during entry reads
• Reject partial GNU sparse map entries
• Preserve payload access for unknown TAR typeflags
• Reject dangling one-shot TAR extensions
• Reject orphaned GNU sparse PAX metadata
• Reject ambiguous NUL-version USTAR headers
• Require valid carrier classes for TAR extensions
• Require decimal PAX numeric overrides
• Use the last repeated PAX pathname
• Test last-record precedence for PAX owner metadata
• Reject empty local PAX values
• Report sparse data positions after continuation headers

Full Changelog: v0.6.2...v0.6.3

• Avoid desync when mixing extensions #82

This release addresses two advisories:

• GHSA-fp55-jw48-c537
• GHSA-xx64-wwv2-hcqq

Purely to shake out any issues with #73.

Signed-off-by: William Woodruff [email protected]

What's Changed

This release addresses GHSA-6gx3-4362-rf54.

• docs: add security considerations to the README and entry::path documentation by @tomasilluminati in #67

New Contributors

• @tomasilluminati made their first contribution in #67

Full Changelog: v0.5.6...v0.6.0

• Fixed a parser desynchronization vulnerability when reading tar archives that
  contain mismatched size information in PAX/ustar headers.

  This vulnerability is being tracked as GHSA-j5gw-2vrg-8fgx
  and CVE-2025-62518.

• Fixed a parser desynchronization vulnerability when reading tar archives that contain mismatched size information in PAX/ustar headers.

  This vulnerability is being tracked as GHSA-j5gw-2vrg-8fgx and CVE-2025-62518.

• This is a corrective release for 0.5.4 to fix a debugging artifact that
  was accidentally left in the release.

• This is a corrective release for 0.5.4 to fix a debugging artifact that was accidentally left in the release.

• Fixed a path traversal vulnerability when using the unpack_in_raw API
  by @charliermarsh

  This vulnerability is being tracked as GHSA-3wgq-wrwc-vqmv.

• Fixed a path traversal vulnerability when using the unpack_in_raw API by @charliermarsh

  This vulnerability is being tracked as GHSA-3wgq-wrwc-vqmv.

Release v0.5.3 for
astral-sh/uv#15202 (comment). The
Cargo.toml is already bumped, so we only need update the Changelog.

• Expose TarError publicly by @konstin in https://github.com/astral-sh/tokio-tar/pull/52

• Enable opt-in to deny creation of symlinks outside target directory by @charliermarsh in https://github.com/astral-sh/tokio-tar/pull/46

• Add test to reproduce issue in impl Stream for Entries causing filename truncation by @charliermarsh in https://github.com/astral-sh/tokio-tar/pull/41
• Avoid truncation during pending reads by @charliermarsh in https://github.com/astral-sh/tokio-tar/pull/40

• Setting preserve_permissions to false will avoid setting any permissions on extracted files. In alexcrichton/tar-rs, setting preserve_permissions to false will still set read, write, and execute permissions on extracted files, but will avoid setting extended permissions (e.g., setuid, setgid, and sticky bits).
• Avoid creating directories outside the unpack target (see: alexcrichton/tar-rs#259).
• Added unpack_in_raw which memoizes the set of validated paths (and assumes a pre-canonicalized) unpack target to avoid redundant filesystem operations.