Skip to content

Conversation

@agronholm
Copy link
Contributor

A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered.

A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered.
@henryiii
Copy link
Contributor

Spacing change in packaging 26.0, name @ <url>, is what's breaking the tests.

@codecov
Copy link

codecov bot commented Jan 21, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.20%. Comparing base (41418fa) to head (c967b66).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #675   +/-   ##
=======================================
  Coverage   53.20%   53.20%           
=======================================
  Files          13       13           
  Lines        1109     1109           
=======================================
  Hits          590      590           
  Misses        519      519           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@agronholm agronholm requested a review from henryiii January 21, 2026 23:33
Copy link
Contributor

@henryiii henryiii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice test.

@agronholm
Copy link
Contributor Author

Nice test.

Thanks. I wasn't initially sure if it'd get tripped by the security issue but it did in my local testing.

@agronholm agronholm merged commit 7a7d2de into main Jan 21, 2026
19 checks passed
@agronholm agronholm deleted the fix-unpack-chmod branch January 21, 2026 23:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants