0 Fork 0

Files

T

james.maesandClaude Fable 5.1 1bc4ddd0be release: qqq 1.0.0 (#11 )

qqq 1.0.0: the command-line client and the full-screen terminal UI (qqq ui) for QQQ applications over the UI API (/qqq/v1), with @qrun-io/qqq-cli 1.0.0, @qrun-io/qqq-core 1.0.0, @qrun-io/qqq-ui-api-client 1.8.0 and @qrun-io/qqq-ui-api-conformance 1.6.0 going final together. Squash of the release/1.0.0 branch at 79ba68e (the branch is kept with the full signed history; the tags v1.8.0 and cli-v1.0.0 point at that commit, which is what the released binaries were built from). See CHANGELOG.md [1.0.0] and docs/release-notes/1.0.0.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-11-01 12:49:06 -06:00

1.9 KiB

Raw Permalink Blame History

Security policy

Supported versions

Version	Supported
1.0.x (`qqq` 1.0, `@qrun-io/qqq-core` 1.0, `@qrun-io/qqq-ui-api-client` 1.8, `@qrun-io/qqq-ui-api-conformance` 1.6)	yes
1.0.0 release candidates, 0.x	no; upgrade to the latest 1.0.x

Fixes are released as a new patch version of the affected packages and binaries.

Reporting a vulnerability

Do not report security problems in public issues, pull requests or discussions.

Email security@qrun.io with:

what is affected (the CLI, qqq ui, a package, the installer or the packaging) and its version (the first line of qqq doctor);
how to reproduce it, and what an attacker gains;
whether the problem is in this client or in the QQQ server (server problems are handled through QRun-IO/qqq).

When private vulnerability reporting is enabled on this repository, you can also use Report a vulnerability.

We acknowledge reports within three business days, keep you informed while we fix it, and credit you in the advisory unless you ask us not to.

Scope notes

Things in scope include: how sign-ins and tokens are stored (OS keyring, the QQQ_KEYRING=file store), OAuth2 device and PKCE flows, handling of server-supplied file names and content, the curl installer and its checksum verification, and the release binaries.

qqq-dev-idp (in @qrun-io/qqq-ui-api-conformance) approves sign-ins without a password by design. It is for local development and tests only; running it where others can reach it is not a vulnerability in this project.

Dependencies

Dependabot watches the npm workspaces and the TUI's Bun lockfile (.github/dependabot.yml). Never commit secrets: use QQQ_TOKEN or the keyring, and keep tokens and private hostnames out of issues and logs you share.