v1.4.525
danielmiessler/Fabricv1.4.525Oct 18, 2026by github-actions[bot]
Upgrading?
AI Summary
This release addresses a security vulnerability in the file manager that allowed writing to the `.git` directory via Windows short names. The update prevents potential Git hook injection by updating path validation logic and adds Windows-specific testing infrastructure.
Key Highlights
- Fixed a security gap allowing writes into the `.git` directory via Windows short names (GIT~1).
- Updated `unsafePath` to reject paths resolving to the same file as `.git` using `os.SameFile`.
- Added Windows test coverage for the `git~1` alias.
- Added a `windows-latest` job to the CI workflow to improve platform stability.
Full Release Notes
## Changes ### PR [#2272](https://github.com/danielmiessler/Fabric/pull/2272) by [ksylvan](https://github.com/ksylvan): fix: refuse writes into .git through its Windows 8.3 short name - Fixed a security gap that allowed writes into the `.git` directory through its Windows 8.3 short name (`GIT~1`), which could let `create_coding_feature` plant a Git hook. - Updated `unsafePath` to reject any path component that resolves to the same file as the `.git` entry in its parent directory, using `os.SameFile`. - Added a Windows test covering the `git~1` alias. - Added a `windows-latest` job to the CI workflow. - Limited the Windows CI job to the file manager domain tests (run with `-v`), since other packages fail on Windows due to path separators, shell scripts, and a notification timeout.
Related Repositories
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
The world’s fastest framework for building websites.
:cherry_blossom: A command-line fuzzy finder