diff --git a/documentation/security-and-reliability/index.md b/documentation/security-and-reliability/index.md index 89bc88d..d9c9ab0 100644 --- a/documentation/security-and-reliability/index.md +++ b/documentation/security-and-reliability/index.md @@ -11,7 +11,7 @@ If you have any security concerns, please report them through the [Security tab | Version | Changes | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------- | -| 2.7.3 | Fixes a security issue that allows attacker to gain access to TCC protected files using the Downloader XPC Service (#2763). Fixes an issue that allows an attacker to execute an arbitrary package installation through the Installer XPC Service with a shown authorization prompt, or through a race condition (#2763). Specific details about these local exploits can be found in [this discussion](https://github.com/sparkle-project/Sparkle/discussions/2764). +| 2.7.3 | Fixes a security issue that allows attacker to gain access to TCC protected files using the Downloader XPC Service ([#2763](https://github.com/sparkle-project/Sparkle/pull/2763)). Fixes an issue that allows an attacker to execute an arbitrary package installation through the Installer XPC Service with a shown authorization prompt, or through a race condition ([#2763](https://github.com/sparkle-project/Sparkle/pull/2763)). Specific details about these local exploits can be found in [this discussion](https://github.com/sparkle-project/Sparkle/discussions/2764). | 2.6.4 | Fixes a security issue that allows an attacker to replace an existing signed update with another payload, which bypasses Sparkle's (Ed)DSA signing checks ([#2550](https://github.com/sparkle-project/Sparkle/pull/2550)); updating is strongly recommended and a fix is also backported to 1.27.3. Fixes an issue for sandboxed apps that enable the Downloader XPC Service from conflicting with each other and presenting a system dialog that "Downloader" differs from previously opened versions affecting macOS 14 and later ([#2511](https://github.com/sparkle-project/Sparkle/pull/2511)). Performs a Gatekeeper scan for signed app updates on macOS 14.4 and later so users don't see a system "Verifying..." dialog when an app update is relaunched ([#2505](https://github.com/sparkle-project/Sparkle/pull/2505)). | | 2.5.2 | Fixes a rare corruption issue resulting in missing files in the installed bundle, which Gatekeeper may reject ([#2479](https://github.com/sparkle-project/Sparkle/pull/2479)). Adopts macOS 14 Sonoma's cooperative app activation APIs instead of using `-[NSApplication activateIgnoringOtherApps:]` which was deprecated in macOS 14 (mainly impacts background/dockless running apps) ([#2409](https://github.com/sparkle-project/Sparkle/pull/2409)). Fixes updates not installing when executed from a Sparkle CLI utility as root (sudo) user on macOS 14 Sonoma (impacts few out-of-app updaters) ([#2432](https://github.com/sparkle-project/Sparkle/pull/2432)). | | 2.4.2 | Fixes `NSKeyedUnarchiver` decoding warning of appcast item that contains delta updates ([#2383](https://github.com/sparkle-project/Sparkle/pull/2383)). Hardens verification of passing the update's download to Sparkle's Autoupdate helper ([#2392](https://github.com/sparkle-project/Sparkle/pull/2392)). |