This release fixes a regression introduced in one of the hardening
features added to filepath-securejoin 0.4.0.
- The restrictions added for
root
paths passed toSecureJoin
in 0.4.0 was
found to be too strict and caused some regressions when folks tried to
update, so this restriction has been relaxed to only return an error if the
path contains a..
component. We still recommend users usefilepath.Clean
(and evenfilepath.EvalSymlinks
) on theroot
path they are using, but at
least you will no longer be punished for "trivial" unclean paths. (#46)
Signed-off-by: Aleksa Sarai [email protected]