Files
Nick f8d5d2c82b fix: ship reviewed CLI file safety and security release notes (#1409)
# Pull Request Description

Integrate the reviewed CLI JSON-read hardening from #1398 and prepare the 16.9.1 security release notes. The original contributor commits are retained in this branch. The fork PR cannot be approved by the protected runtime-path policy; this owner-authored PR uses the exact-head maintainer review path without changing that policy.

Validation and reads now use the same file descriptor, reject a replaced file or raced FIFO, and enforce the byte limit even when the file grows. The input error contract and ordinary CLI behavior remain unchanged. No new runtime imports are introduced.

Validation: 25 focused CLI tests and all 126 repository test files pass, plus validation, reference and documentation-security checks. Packed Linux/Windows verification is required before release.

Co-authored-by: Beverly621 <205182701+Beverly621@users.noreply.github.com>
2026-09-06 16:39:31 +02:00
..