Archon fixes binaries that could reload a project's environment file
Archon released version 0.12.1 on October 17. Its maintainers say the version 0.12.0 provider binaries could reload keys from a project's environment file after the main program removed them. A project API key could then override the user's subscription. Source installs were not affected.
Verified 12:56 AM PDT · 2 original sources
These are maintainer claims about one configuration-loading defect. The release does not prove that every Archon security issue is fixed, or establish that users suffered unauthorized charges.
Archon's maintainers recommend that affected binary users upgrade and add the provider plugins again. Check the provider configuration before running another project.
Audit the story
Original sources
Company claims remain company claims. Follow the reporting and judge the evidence directly.
- Archon maintainersArchon CLI v0.12.1 release ↗
- Archon maintainersRelease binaries no longer load the target repository environment ↗
Continue the edition