v0.6.3

What's Changed

• Remove filetime dependency
• Reject mixed PAX and GNU path metadata
• Reject unterminated PAX records
• Reject mixed PAX and GNU link targets
• Trim GNU long names and links at NUL
• Add a restricted local-PAX input mode
• Parse PAX records by declared length
• Apply PAX owner names to entries
• Apply PAX size overrides to entry headers
• Apply Solaris X metadata only on USTAR carriers
• Report truncated TAR payloads during entry reads
• Reject partial GNU sparse map entries
• Preserve payload access for unknown TAR typeflags
• Reject dangling one-shot TAR extensions
• Reject orphaned GNU sparse PAX metadata
• Reject ambiguous NUL-version USTAR headers
• Require valid carrier classes for TAR extensions
• Require decimal PAX numeric overrides
• Use the last repeated PAX pathname
• Test last-record precedence for PAX owner metadata
• Reject empty local PAX values
• Report sparse data positions after continuation headers

Full Changelog: v0.6.2...v0.6.3

v0.6.2

• Avoid desync when mixing extensions #82

v0.6.1

This release addresses two advisories:

• GHSA-fp55-jw48-c537
• GHSA-xx64-wwv2-hcqq

v0.6.0

What's Changed

This release addresses GHSA-6gx3-4362-rf54.

• docs: add security considerations to the README and entry::path documentation by @tomasilluminati in #67

New Contributors

• @tomasilluminati made their first contribution in #67

Full Changelog: v0.5.6...v0.6.0

v0.5.6

• Fixed a parser desynchronization vulnerability when reading tar archives that
  contain mismatched size information in PAX/ustar headers.

  This vulnerability is being tracked as GHSA-j5gw-2vrg-8fgx
  and CVE-2025-62518.

v0.5.5

• This is a corrective release for 0.5.4 to fix a debugging artifact that
  was accidentally left in the release.

v0.5.4

• Fixed a path traversal vulnerability when using the unpack_in_raw API
  by @charliermarsh

  This vulnerability is being tracked as GHSA-3wgq-wrwc-vqmv.

v0.5.2

What's Changed

• Enable opt-in to deny creation of symlinks outside target directory by @charliermarsh in #46

Full Changelog: v0.5.1...v0.5.2

v0.5.1

What's Changed

• Add test to reproduce issue in impl Stream for Entries causing filename truncation by @charliermarsh in #41
• Avoid truncation during pending reads by @charliermarsh in #40

Full Changelog: v0.5.0...v0.5.1