Justin M. Keyes f83e0dcaf8 fix(vim.secure): read() command injection vulnerability #39918 ...

Problem:
Malicious filename can execute code because of ":" cmdline expansion.

Solution:
Use `fnameescape()`.

fix https://github.com/neovim/neovim/issues/39914

(cherry picked from commit 799cbfff85)

2026-05-20 20:00:45 +00:00

..

_core

fix(startup): emitting useless OptionSet

2026-05-17 18:24:50 +02:00

_ftplugin

fix(runtime): 'includeexpr' with non-Nvim-style Lua modules #33867

2025-05-06 05:15:31 -07:00

_meta

fix(startup): emitting useless OptionSet

2026-05-17 18:24:50 +02:00

deprecated

refactor: rename _ensure_integer => _assert_integer

2026-03-13 20:32:01 +01:00

filetype

vim-patch:9.2.0500: filetype: some html files wrongly recognized as htmlangular (#39880)

2026-05-19 01:08:18 +00:00

func

refactor: rename _ensure_integer => _assert_integer

2026-03-13 20:32:01 +01:00

health

backport: refactor: update usages of deprecated "buffer" param #39090

2026-04-15 19:46:07 +00:00

lsp

backport: opts.scope in vim.ui.input (#39906)

2026-05-20 08:44:03 +00:00

net

feat(ssh): SSH configuration parser #35027

2025-08-17 20:40:28 -07:00

pack

fix(pack): GIT_DIR/GIT_WORK_TREE env vars may interfere #39279

2026-04-22 09:24:45 +00:00

provider

fix(provider): support python3.14 #38419

2026-03-22 09:20:04 -04:00

treesitter

fix(treesitter): get_node_text() inconsistent trailing newline #39409

2026-05-03 13:53:04 +00:00

ui/clipboard

docs: use "ev" convention in event-handlers

2026-03-12 11:12:56 +01:00

_async.lua

fix(vim.pack): increase default timeout #36992

2025-12-16 13:22:05 -05:00

_comment.lua

refactor(treesitter)!: get_parser return nil on error #37276

2026-03-13 15:57:36 -04:00

_init_packages.lua

build: move shared.lua to _core/

2025-12-30 01:44:52 -05:00

_inspector.lua

backport fix(lsp): send didClose, didOpen when languageId changes (#39519)

2026-04-30 13:09:55 +00:00

_meta.lua

backport: docs: misc (#39395)

2026-04-25 13:51:22 -04:00

_watch.lua

fix(watch): invalid joined path #37973

2026-02-23 17:33:13 -05:00

diagnostic.lua

docs: misc, rename "tabpage"

2026-05-07 12:03:02 +02:00

F.lua

fix: type fixes

2025-06-06 15:36:48 +01:00

filetype.lua

backport fix(lsp): send didClose, didOpen when languageId changes (#39519)

2026-04-30 13:09:55 +00:00

fs.lua

backport: docs: misc (#39395)

2026-04-25 13:51:22 -04:00

func.lua

refactor(lsp): drop once(), use _memoize() #37829

2026-02-12 07:15:20 -05:00

glob.lua

fix(glob): handle numeric literals in pattern matching (#37257)

2026-01-12 10:58:01 -08:00

health.lua

fix(progress): require "source" for progress-message #38514

2026-03-28 09:22:22 -04:00

hl.lua

backport fix(lsp): send didClose, didOpen when languageId changes (#39519)

2026-04-30 13:09:55 +00:00

inspect.lua

feat(inspect): update to a8ca312

2026-01-09 10:07:15 +01:00

iter.lua

docs: api, messages, lsp, trust

2026-03-11 18:00:18 +01:00

keymap.lua

fix(lua): drop support for boolean buf in vim.keymap #38432

2026-03-23 08:00:53 -04:00

loader.lua

refactor: integer functions, optimize asserts #34112

2026-03-12 11:04:05 -04:00

lsp.lua

backport fix(lsp): send didClose, didOpen when languageId changes (#39519)

2026-04-30 13:09:55 +00:00

net.lua

fix(vim.net): check if vim.system's stdout is nil #38713

2026-04-05 19:24:57 +00:00

pack.lua

fix(pack): only use tags that strictly comply with semver spec #39342

2026-04-23 15:55:14 +00:00

pos.lua

feat(pos): pos:to_offset(), pos.offset() (#39639)

2026-05-07 05:16:53 -04:00

provider.lua

refactor: create function for deferred loading

2024-02-03 16:53:41 +01:00

range.lua

fix(vim.range): empty ranges semantics vs regular ranges #39474

2026-05-08 10:17:30 +00:00

re.lua

build: set luals checklevel to Hint #32392

2025-02-10 03:04:01 -08:00

secure.lua

fix(vim.secure): read() command injection vulnerability #39918

2026-05-20 20:00:45 +00:00

snippet.lua

backport fix(lsp): send didClose, didOpen when languageId changes (#39519)

2026-04-30 13:09:55 +00:00

text.lua

fix(lua): vim.diff is nil in uv.new_work() thread #34909

2025-07-12 20:54:22 -07:00

treesitter.lua

backport fix(treesitter): drop select() kwargs (#39647)

2026-05-07 11:21:05 +00:00

tty.lua

refactor: rename termcap.lua -> tty.lua #38437

2026-03-23 10:14:48 -04:00

ui.lua

backport: opts.scope in vim.ui.input (#39906)

2026-05-20 08:44:03 +00:00

uri.lua

backport fix(lsp): send didClose, didOpen when languageId changes (#39519)

2026-04-30 13:09:55 +00:00

version.lua

feat(vim.version): add __eq to vim.VersionRange #38881

2026-04-08 23:26:03 +02:00