Starstruk Logo MarkStarstruk

1.3.1

Genymobile/scrcpy1.3.1Aug 29, 2026by github-actions[bot]

AI Summary

A patch release addressing multiple security vulnerabilities in the Containerization package, including issues with unchecked IDs, path traversal, and invalid file names causing crashes.

Key Highlights

  • Fixes for unchecked IDs allowing file deletion outside bundles.
  • Fixes for unvalidated OCI descriptor digests enabling path traversal.
  • Fixes for symlink-based host file reading during image loading.
  • Fixes for crashes caused by invalid file names and extended-attribute names.
  • Update to containerization version 0.42.0.

New Features

  • Addition of container skill.
  • Fix for tmpfs mount source field being left empty.
  • Updated to containerization 0.42.0.

Full Release Notes

This patch release addresses a number of security issues in the Containerization package:

- [GHSA-x7pf-2jmj-pgcq](https://github.com/apple/containerization/security/advisories/GHSA-x7pf-2jmj-pgcq) - Creating a container or executing a container process can delete files outside its bundle through an unchecked id
- [GHSA-f689-h8m7-3jp2](https://github.com/apple/containerization/security/advisories/GHSA-f689-h8m7-3jp2) - `ContainerizationOCI` accepts unvalidated OCI descriptor digests, enabling path traversal in the local content store
- [GHSA-r3h2-rgqf-9hv9](https://github.com/apple/containerization/security/advisories/GHSA-r3h2-rgqf-9hv9) - Loading an OCI image layout can read host files through a symlink
- [GHSA-mx96-5vvg-x2mg](https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg) - CVE-2026-65388 - `RegistryClient` follows the `WWW-Authenticate` realm without validating its host or scheme
- [GHSA-697p-8837-37h3](https://github.com/apple/containerization/security/advisories/GHSA-697p-8837-37h3) - Unpacking a crafted image layer with a long(invalid) file name crashes the unpacking process
- [GHSA-g3rx-2m58-rr63](https://github.com/apple/containerization/security/advisories/GHSA-g3rx-2m58-rr63) - Unpacking a crafted image layer with an invalid length extended-attribute name crashes the unpacking process

## What's Changed
* Add container skill by @crosbymichael in https://github.com/apple/container/pull/2154
* Fix tmpfs mount source field left empty for --mount type=tmpfs by @sivasath16 in https://github.com/apple/container/pull/2138
* Update to containerization 0.42.0 by @katiewasnothere in https://github.com/apple/container/pull/2207

## New Contributors
* @sivasath16 made their first contribution in https://github.com/apple/container/pull/2138

**Full Changelog**: https://github.com/apple/container/compare/1.3.0...1.3.1