Starstruk Logo MarkStarstruk

files-v0.6.10

actix/actix-webfiles-v0.6.10Feb 6, 2026by JohnTitor

AI Summary

This security-focused release addresses two vulnerabilities related to panic on empty Range headers and serving the current working directory on invalid inputs, while also updating MSRV to 1.88 and making some internal types public.

Key Highlights

  • Security fixes for 2 vulnerabilities (empty Range header panic, CWD exposure)
  • MSRV updated to 1.88
  • Made PathBufWrap and UriSegmentError public

New Features

  • Do not panic with empty Range header
  • Avoid serving CWD on invalid Files::new inputs
  • Made PathBufWrap and UriSegmentError public

Full Release Notes

## 0.6.10

### Security Notice

We addressed 2 vulnerabilities in this release:

- Do not panic with empty Range header (https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p).
- Avoid serving CWD on invalid `Files::new` inputs (https://github.com/actix/actix-web/security/advisories/GHSA-8v2v-wjwg-vx6r).

We encourage updating your `actix-files` version as soon as possible.

### Other changes

- Minimum supported Rust version (MSRV) is now 1.88.
- `PathBufWrap` & `UriSegmentError` made public. [#3694]

[#3694]: https://github.com/actix/actix-web/pull/3694