Skip to content

Fix missing links to PRs in security page #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 26, 2025
Merged

Fix missing links to PRs in security page #236

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion documentation/security-and-reliability/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ If you have any security concerns, please report them through the [Security tab

| Version | Changes |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| 2.7.3 | Fixes a security issue that allows attacker to gain access to TCC protected files using the Downloader XPC Service (#2763). Fixes an issue that allows an attacker to execute an arbitrary package installation through the Installer XPC Service with a shown authorization prompt, or through a race condition (#2763). Specific details about these local exploits can be found in [this discussion](https://github.com/sparkle-project/Sparkle/discussions/2764).
| 2.7.3 | Fixes a security issue that allows attacker to gain access to TCC protected files using the Downloader XPC Service ([#2763](https://github.com/sparkle-project/Sparkle/pull/2763)). Fixes an issue that allows an attacker to execute an arbitrary package installation through the Installer XPC Service with a shown authorization prompt, or through a race condition ([#2763](https://github.com/sparkle-project/Sparkle/pull/2763)). Specific details about these local exploits can be found in [this discussion](https://github.com/sparkle-project/Sparkle/discussions/2764).
| 2.6.4 | Fixes a security issue that allows an attacker to replace an existing signed update with another payload, which bypasses Sparkle's (Ed)DSA signing checks ([#2550](https://github.com/sparkle-project/Sparkle/pull/2550)); updating is strongly recommended and a fix is also backported to 1.27.3. Fixes an issue for sandboxed apps that enable the Downloader XPC Service from conflicting with each other and presenting a system dialog that "Downloader" differs from previously opened versions affecting macOS 14 and later ([#2511](https://github.com/sparkle-project/Sparkle/pull/2511)). Performs a Gatekeeper scan for signed app updates on macOS 14.4 and later so users don't see a system "Verifying..." dialog when an app update is relaunched ([#2505](https://github.com/sparkle-project/Sparkle/pull/2505)). |
| 2.5.2 | Fixes a rare corruption issue resulting in missing files in the installed bundle, which Gatekeeper may reject ([#2479](https://github.com/sparkle-project/Sparkle/pull/2479)). Adopts macOS 14 Sonoma's cooperative app activation APIs instead of using `-[NSApplication activateIgnoringOtherApps:]` which was deprecated in macOS 14 (mainly impacts background/dockless running apps) ([#2409](https://github.com/sparkle-project/Sparkle/pull/2409)). Fixes updates not installing when executed from a Sparkle CLI utility as root (sudo) user on macOS 14 Sonoma (impacts few out-of-app updaters) ([#2432](https://github.com/sparkle-project/Sparkle/pull/2432)). |
| 2.4.2 | Fixes `NSKeyedUnarchiver` decoding warning of appcast item that contains delta updates ([#2383](https://github.com/sparkle-project/Sparkle/pull/2383)). Hardens verification of passing the update's download to Sparkle's Autoupdate helper ([#2392](https://github.com/sparkle-project/Sparkle/pull/2392)). |
Expand Down