8000 Update fzf to 0.74.5 by gominimal-pkgmgr-mgr[bot] · Pull Request #855 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update fzf to 0.74.5 - #855

Merged
bryan-minimal merged 1 commit into
mainfrom
update-fzf-0.74.5
Oct 12, 2026
Merged

Update fzf to 0.74.5#855
bryan-minimal merged 1 commit into
mainfrom
update-fzf-0.74.5

Conversation

@gominimal-pkgmgr-mgr
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot commented Oct 11, 2026
Copy link
Copy Markdown
Contributor

Update fzf 0.74.4 → 0.74.5

Source: github:junegunn/fzf
Release: https://github.com/junegunn/fzf/releases/tag/v0.74.5
Changelog: junegunn/fzf@v0.74.4...v0.74.5
Released: 20 hours ago (2026-10-11)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 0.74.5 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 1 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (1)

This update clears 1 vulnerabilities affecting 0.74.4:

CVE / GHSA Severity Fixed in
GHSA-7rj6-7pqx-v7rm MEDIUM via range: <= 0.74.4
Advisory summaries
  • GHSA-7rj6-7pqx-v7rm — Predictable FIFO path in zsh completion allows local symlink attack / arbitrary file overwrite as the victim user (_fzf_feed_fifo) (Published 2026-10-11)

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ fzf 0.74.4 0.74.5
~ fzf-upstream 0.74.4 0.74.5

Changes

Old New
Version 0.74.4 0.74.5
SHA256 1046857c337f5bd0... 5529d08897b85ae7...
Size 485 KB 492 KB
Source gs://minimal-staging-archives/junegunn/fzf/v0.74.4.tar.gz gs://minimal-staging-archives/junegunn/fzf/v0.74.5.tar.gz
  • License: MIT (source: GitHub + tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner October 11, 2026 22:47
@coderabbitai
coderabbitai Bot commented Oct 11, 2026
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d27ca46b-cc14-4a4d-8846-53dbac244479

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 12, 2026
Merged via the queue into main with commit 625f8d1 Oct 12, 2026
11 checks passed
@bryan-minimal
bryan-minimal deleted the update-fzf-0.74.5 branch October 12, 2026 19:13
This was referenced Oct 26, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bryan-minimal bryan-minimal bryan-minimal approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bryan-minimal
0