COMMITS
September 12, 2026
A
Merge pull request #2916 from d2lang/security/render-paint-validation
Alexander Wang committed
A
Merge pull request #2912 from d2lang/security/render-target-validation
Alexander Wang committed
A
Merge pull request #2917 from d2lang/security/legend-link-validation
Alexander Wang committed
A
Merge pull request #2915 from d2lang/security/npm-token-config-permissions
Alexander Wang committed
A
Merge pull request #2914 from d2lang/security/ci-verify-pandoc
Alexander Wang committed
A
Merge pull request #2913 from d2lang/security/ci-local-d2-formatter
Alexander Wang committed
A
Merge pull request #2911 from d2lang/security/image-bundler-limits
Alexander Wang committed
A
Merge pull request #2910 from d2lang/security/watch-access-token
Alexander Wang committed
A
Merge pull request #2909 from d2lang/security/svg-color-attribute-escape
Alexander Wang committed
A
Merge pull request #2908 from d2lang/security/board-output-toctou
Alexander Wang committed
A
Merge pull request #2907 from d2lang/security/composite-variable-cycle
Alexander Wang committed
A
Merge pull request #2906 from d2lang/security/svg-clip-path-id
Alexander Wang committed
A
Merge pull request #2905 from d2lang/security/gradient-stop-validation
Alexander Wang committed
A
Merge pull request #2904 from d2lang/security/import-depth-limit
Alexander Wang committed
A
Merge pull request #2903 from d2lang/security/svg-sql-constraint-escape
Alexander Wang committed
A
Merge pull request #2902 from d2lang/security/url-decode-limit
Alexander Wang committed
September 11, 2026
A
fix(svg): validate raw render paints
Alexander Wang committed
A
Reject dangerous legend shape links
Alexander Wang committed
A
security: protect local npm publish token
Alexander Wang committed
A
security: verify CI Pandoc package
Alexander Wang committed
A
security: build CI formatter from checkout
Alexander Wang committed
A
security: validate raw render targets
Alexander Wang committed
A
security: bound image bundling resources
Alexander Wang committed
A
security: authenticate watch server access
Alexander Wang committed
A
fix: contain board output publication races
Alexander Wang committed
A
security: reject cyclic composite variables
Alexander Wang committed
A
fix: escape SVG color attributes
Alexander Wang committed
A
security: encode SVG clip-path identifiers
Alexander Wang committed
A
security: validate SVG gradient stop positions
Alexander Wang committed
A
security: bound recursive import depth
Alexander Wang committed