Thanks again to dcRUSTy in reporting both the vulnerabilities causing a release this weekend. For those interested, the security policy contains instructions on reporting security vulnerabilities, and I welcome feedback on improving the process moving forward. I will always aspire to release significant security fixes on an accelerated schedule.
/releasespages allowed a path traversal vulnerability, potentially exposing other files on the filesystem.
Many thanks to the following kind folks for help with this release, either through bug reports, suggestions, or direct code contributions:
npm install -g firstname.lastname@example.org
|Option||node.js required?||sudo required?||links||Description|
|Self-contained archives||No||No||Simply unpack and run
|source tarball||Yes||No||source tarball if you roll that way.|
Windows path limitations
*mountebank wishes very much for your Windows experience to be hassle-free, but he is simply not qualified to address a particular constraint of Windows Explorer. For legacy reasons, some Windows applications, including most notably Windows Explorer, have a maximum number of characters allowed in a path of 260 characters. As mountebank writes these words, the longest path he includes in the zip files is around 175 characters. The zip file name, which is likely to represent itself as two nested directories if you use the defaults to unzip it, will be around 25 characters. That gives you very little wiggle room. If you unzip the file in your users directory, you may very likely get an error because of this constraint.
The following solutions will all work:
- Unzip to the root of your C: drive (or a similar small path)
- Use 7zip to unzip the file instead of Windows Explorer
npmto install mountebank instead of the zip file