From aefa1baf5d581882648d7696778980a518dcc41a Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Fri, 7 Aug 2026 15:42:36 +0300 Subject: [PATCH] Add changelog entry for v2.2.3 Signed-off-by: Stefan Prodan (cherry picked from commit de867a455520e6b15054720db99646f0c39a4c58) --- CHANGELOG.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a65bc29..b51c3d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,25 @@ All notable changes to this project are documented in this file. +## 2.2.3 + +**Release date:** 2026-08-07 + +This patch release aligns the tarball extraction performed by `Extract` copy +operations with the other copy operations, so that it writes through `os.Root` +and stays confined to the artifact root. It also bounds the expansion of the +`from` and `exclude` glob patterns, which may now contain at most 20 commas +inside `{}` alternation groups. On the `ArtifactGenerator` API, the `to` field +validation pattern no longer accepts `.` and `..` path segments, and each +`exclude` pattern is limited to 1024 characters. + +Note that this release contains a CRD schema change, the `ArtifactGenerator` +CRD must be updated along with the controller. + +Fixes: +- Confine tarball extraction and bound glob expansion + [#374](https://github.com/fluxcd/source-watcher/pull/374) + ## 2.2.2 **Release date:** 2026-07-07