Morph MORPH
SIGN IN SIGN UP
dhruvhead / clasp UNCLAIMED
0 0 0 TypeScript

COMMITS

master
August 28, 2026
R
chore(master): release 3.4.1 (#1167)
release-please[bot] committed
e9441e5
S
test(commands): normalize stubbed localPath in unsafe deletion test
Steven Bazyl committed
b907723
S
test(commands): normalize path separators in pull tests for Windows compatibility
Steven Bazyl committed
af0332f
S
fix(files): prevent rootDir double application during pull, clone, and create
Steven Bazyl committed
13d3322
August 20, 2026
R
chore(master): release 3.4.0 (#1138)
release-please[bot] committed
efd0524
S
test(core): normalize localPath in files_security tests for Windows compatibility
Steven Bazyl committed
ec5608c
S
Regenerate package-lock.json
Steven Bazyl committed
6b6c742
August 19, 2026
S
chore(deps): update minor/patch dependencies and fix transitive audit vulnerabilities
Steven Bazyl committed
be55a0d
S
fix(deps): update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues
Steven Bazyl committed
87a3759
S
fix(auth): secure credential file writing with symlink protection and permissions
Steven Bazyl committed
378c1a6
S
Reformat files
Steven Bazyl committed
e7b8cd4
August 18, 2026
S
feat(cli): add global --allow-symlinks option for shared symlinked folders/files
Steven Bazyl committed
78d7104
S
fix(security): clean up CSRF demo script and harden path boundary & test mocks
Steven Bazyl committed
0a28a48
S
chore(ci): exclude oauth_client.ts from GitHub secret scanning
Steven Bazyl committed
f208f66
S
feat(commands): surface security warnings for skipped files and enforce strict deletion boundaries
Steven Bazyl committed
f2d835d
S
fix(core): secure file system crawling, atomic writes, and structured security reporting
Steven Bazyl committed
aa4cfeb
S
fix(auth): restore OAuth client secret for desktop public client compatibility
Steven Bazyl committed
be27aaf
B
docs: update Cloud Logging references (#1161)
Bill committed
089cda4
June 8, 2026
S
Fix: Print help instead of throwing error on unknown commands (#1157)
Steve Bazyl committed
39a9c12
June 1, 2026
L
fix(security) : Fix path traversal via malicious .clasp.json srcDir (#1145)
LAKSHMIKANTHAN K committed
93c5ddc
May 28, 2026
S
fix(create-script): accept --type webapp and --type api as standalone aliases (#1155)
Sheita committed
34a468e
April 27, 2026
S
chore(deps): update @formatjs/intl to v4 (#1153)
Steve Bazyl committed
0fe9562
S
chore: upgrade googleapis to ^149.0.0 (#1152)
Steve Bazyl committed
9e484cb
April 14, 2026
L
fix(security) : Fix race condition in file write operations (Symlink TOCTOU) (#1146)
LAKSHMIKANTHAN K committed
08e51a3
April 9, 2026
Ⳕ
fix(security): validate sourceDir MCP parameter and use realpath in WriteFiles (#1144)
ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 committed
4eb9dca
April 7, 2026
Ⳕ
fix(auth): remove hardcoded OAuth client secret from published npm package (CWE-798) (#1139)
ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 committed
a678e92
S
feat: implement PKCE support in OAuth flows (#1142)
Steve Bazyl committed
1a1665e
T
fix(mcp): validate projectDir against permitted base paths (CWE-22 path traversal) (#1141)
Tanishq Shah committed
1e8132c
L
fix(security): prevent path traversal via srcDir in .clasp.json (#1140)
LAKSHMIKANTHAN K committed
408448e
March 25, 2026
K
fix: prevent OAuth CSRF via missing state parameter in authorization flow (#1135)
Karan Kurani committed
8dac6c2