security: release 1.2.1

API_SUPPORT.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "1.2.0",
+  "sdkVersion": "1.2.1",
   "releaseStatus": "stable",
   "pluginPeerRange": ">=1.0.0 <2.0.0",
   "policy": "docs/SUPPORT_POLICY.md",

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.2.1 — 2026-10-15
+
+- Fix protected workspace path reads and creation through Windows 8.3 short-name aliases. Affected versions: <=1.2.0; fixed in 1.2.1.
+- Bound nested default expansion to prevent memory exhaustion. Affected versions: <=1.2.0; fixed in 1.2.1.
+- Preserve the public API, schema contracts and package exports; generated schema version identifiers follow the SDK version.
+
 ## 1.2.0 — 2026-10-05
 
 - Add bounded command DAGs with typed output bindings, exact plan approval, per-step grants, existing command-job integration and durable CAS checkpoints. Explicit restart recovery and retries create new attempts without automatic replay.

README.md

@@ -10,6 +10,10 @@ a small ESM package, TypeScript declarations and versioned contracts. Connect
 your own workspace and tools with the Node.js host and HTTP client. The SDK has
 **zero runtime dependencies**.
 
+Version **1.2.1** fixes Windows protected-path aliases and nested default expansion
+memory exhaustion affecting versions <=1.2.0. See the [changelog](CHANGELOG.md)
+and [security guidance](SECURITY.md). Public APIs, schema contracts and exports remain compatible.
+
 Version **1.2.0** adds [command workflows and incremental cache](docs/WORKFLOWS.md),
 [registered tool streams](docs/TOOL_STREAMS.md) and a [public stdio LSP bridge](docs/LSP.md).
 Run `npm run example:workflows`, `npm run example:workflow-tools` and `npm run example:lsp`
@@ -30,7 +34,7 @@ Run `npm run example:conformance`, `npm run example:conformance-browser` or
 `npm run example:combined` to check independent Node/browser hosts and the combined
 language/settings/edit/job/watch/transfer workload. New plugin packages declare `>=1.0.0 <2.0.0`. The
 [1.0 release contents and acceptance](docs/RELEASE_1_0.md) distinguish functional
-acceptance from the deferred security audit. SDK delivery is separate from DDS
+acceptance from security review. SDK delivery is separate from DDS
 product acceptance.
 
 Version 0.13 adds six [project templates and guarded contract generation](docs/DEVTOOLS.md),
@@ -70,7 +74,7 @@ application, private engines/services and production signing systems are outside
 this repository. Read the [public scope](docs/PUBLIC_SCOPE.md) and
 [compatibility table](docs/COMPATIBILITY.md) for exact boundaries.
 
-Version **1.2.0** supports Node 22 and 24. Manifest v1 diagnostic plugins remain
+Version **1.2.1** supports Node 22 and 24. Manifest v1 diagnostic plugins remain
 compatible. Manifest v2 adds commands, permission-scoped workspace and backend
 APIs, and open-source or proprietary distribution metadata. Themes export to
 the XML format already supported by DDS. The workspace host runs trusted plugins
@@ -130,7 +134,7 @@ mkdir my-dds-plugin
 cd my-dds-plugin
 npm init -y
 npm pkg set type=module
-npm install --ignore-scripts --save-exact https://github.com/Altifigence/dds-plugin-sdk/releases/download/v1.2.0/altifigence-dds-plugin-sdk-1.2.0.tgz
+npm install --ignore-scripts --save-exact https://github.com/Altifigence/dds-plugin-sdk/releases/download/v1.2.1/altifigence-dds-plugin-sdk-1.2.1.tgz
 ```
 
 Copy the example's `plugin.mjs` and `run.mjs` into this directory, then run:

SECURITY.md

@@ -1,6 +1,6 @@
 # Security
 
-The current stable API release is **1.2.0**. It retains the security fixes from
+The current stable API release is **1.2.1**. It retains the security fixes from
 0.3.2. Update workspace servers and clients together, using a current patched
 Node 22 or 24; do not use a pre-0.3.2 workspace host.
 Report an SDK
@@ -12,9 +12,14 @@ exploit details or project data in an issue.
 Include the SDK version, a minimal synthetic reproducer, expected behavior and
 impact. Omit credentials, customer source and private filesystem paths.
 
-The post-0.7 security audit and vulnerability validation are pending under the
-owner's 2026-10-05 deferral. Functional and release checks do not complete that
-audit or establish that its unvalidated candidates are resolved.
+## 1.2.1 security fixes
+
+The resumed security review identified two issues affecting SDK versions <=1.2.0:
+protected workspace path reads and creation through Windows 8.3 short-name aliases,
+and memory exhaustion during nested default expansion. Both are fixed in 1.2.1.
+Update operator-owned workspace hosts and SDK clients to 1.2.1. Public APIs,
+schema contracts and package exports remain compatible. These targeted fixes do
+not establish that every vulnerability is resolved or that DDS product hosts are accepted.
 
 ## 0.3.2 boundary fixes
 
@@ -59,8 +64,10 @@ protect storage, verify the current identity and implement revocation themselves
 
 ## 한국어
 
-현재 안정 API 릴리스는 **1.2.0**이며 0.3.2의 보안 수정을 유지합니다. workspace **서버와 클라이언트를 모두
-0.3.2 이상**으로 갱신하고 Node 22/24의 최신 보안 패치를 사용하세요. 클라이언트만
+현재 안정 API 릴리스는 **1.2.1**이며 0.3.2의 보안 수정을 유지합니다. 1.2.0 이하에 영향을 주는
+Windows 8.3 짧은 이름 별칭의 보호 경로 읽기·생성과 중첩 기본값 확장의 메모리 고갈을
+1.2.1에서 수정했습니다. workspace **서버와 클라이언트를 모두 1.2.1**로 갱신하고
+Node 22/24의 최신 보안 패치를 사용하세요. 클라이언트만
 갱신하면 오래된 서버의 파일 검사와 요청 수신 제한은 바뀌지 않습니다.
 
 0.3.1에서 합성 파일과 로컬 서버로 재현한 하드링크를 통한 파일 노출, 일부 자격증명

docs/SUPPORT_POLICY.md

@@ -1,9 +1,9 @@
 # SDK 1.x support and migration
 
-`1.2.0` is the current stable SDK release in the 1.x line. Pin the installed archive; newly packed plugins
-use `>=1.0.0 <2.0.0`. The policy below applies to this line. Security audit and
-vulnerability validation remain pending under the owner's 2026-10-05 deferral;
-stable API status does not constitute security or DDS product acceptance.
+`1.2.1` is the current stable SDK release in the 1.x line. Pin the installed archive; newly packed plugins
+use `>=1.0.0 <2.0.0`. The policy below applies to this line. The resumed security
+review fixes two issues affecting versions <=1.2.0; see [security guidance](../SECURITY.md).
+Stable API status does not constitute complete security or DDS product acceptance.
 
 ## Public API and optional features
 
@@ -27,7 +27,7 @@ experimental changes are announced in minor-release notes and require fresh
 acceptance. Its presence is not a cross-browser compatibility claim. Other browser
 ports also require their documented capability and permission checks.
 
-No stable API is deprecated in 1.2.0. Future deprecations appear in declarations,
+No stable API is deprecated in 1.2.1. Future deprecations appear in declarations,
 the changelog and migration guide for at least two minor releases and six months
 before removal in a new major. Runtime execution does not emit unsolicited warning
 logs or change grants. A security emergency is documented explicitly.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@altifigence/dds-plugin-sdk",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Plugin, theme and user-owned workspace tools for Digital Design Studio",
   "type": "module",
   "license": "Apache-2.0",

schemas/artifact-sink-capabilities.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/artifact-sink-capabilities.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/artifact-sink-capabilities.schema.json",
   "title": "artifact-sink-capabilities",
   "type": "object",
   "properties": {

schemas/artifact-storage-capabilities.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/artifact-storage-capabilities.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/artifact-storage-capabilities.schema.json",
   "title": "artifact-storage-capabilities",
   "oneOf": [
     {

schemas/artifact-transfer-receipt.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/artifact-transfer-receipt.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/artifact-transfer-receipt.schema.json",
   "title": "artifact-transfer-receipt",
   "type": "object",
   "properties": {

schemas/binary-artifact-capabilities.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/binary-artifact-capabilities.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/binary-artifact-capabilities.schema.json",
   "title": "binary-artifact-capabilities",
   "type": "object",
   "properties": {

schemas/binary-artifact-chunk.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/binary-artifact-chunk.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/binary-artifact-chunk.schema.json",
   "title": "binary-artifact-chunk",
   "type": "object",
   "properties": {

schemas/binary-artifact-list.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/binary-artifact-list.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/binary-artifact-list.schema.json",
   "title": "binary-artifact-list",
   "type": "object",
   "properties": {

schemas/binary-artifact-reference.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/binary-artifact-reference.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/binary-artifact-reference.schema.json",
   "title": "binary-artifact-reference",
   "type": "object",
   "properties": {

schemas/binary-artifact.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/binary-artifact.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/binary-artifact.schema.json",
   "title": "binary-artifact",
   "type": "object",
   "properties": {

schemas/browser-artifact-checkpoint.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/browser-artifact-checkpoint.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/browser-artifact-checkpoint.schema.json",
   "title": "browser-artifact-checkpoint",
   "type": "object",
   "properties": {

schemas/bundle-dependency.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/bundle-dependency.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/bundle-dependency.schema.json",
   "title": "bundle-dependency",
   "type": "object",
   "properties": {

schemas/code-action.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/code-action.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/code-action.schema.json",
   "title": "code-action",
   "type": "object",
   "properties": {

schemas/command.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/command.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/command.schema.json",
   "title": "command",
   "type": "object",
   "properties": {

schemas/completion-item.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/completion-item.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/completion-item.schema.json",
   "title": "completion-item",
   "type": "object",
   "properties": {

schemas/conformance-report.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/conformance-report.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/conformance-report.schema.json",
   "title": "conformance-report",
   "type": "object",
   "properties": {

schemas/data-schema.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/data-schema.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/data-schema.schema.json",
   "title": "data-schema",
   "type": "object",
   "properties": {

schemas/development-definition.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/development-definition.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/development-definition.schema.json",
   "title": "development-definition",
   "type": "object",
   "properties": {
@@ -20,18 +20,18 @@
     "commands": {
       "type": "array",
       "items": {
-        "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/command.schema.json"
+        "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/command.schema.json"
       },
       "maxItems": 64
     },
     "settings": {
-      "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/settings-definition.schema.json"
+      "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/settings-definition.schema.json"
     },
     "catalog": {
-      "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/locale-catalog.schema.json"
+      "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/locale-catalog.schema.json"
     },
     "theme": {
-      "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/theme.schema.json"
+      "$ref": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/theme.schema.json"
     }
   },
   "required": [

schemas/diagnostic-report.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/diagnostic-report.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/diagnostic-report.schema.json",
   "title": "diagnostic-report",
   "type": "object",
   "properties": {

schemas/diagnostics-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/diagnostics-request.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/diagnostics-request.schema.json",
   "title": "diagnostics-request",
   "type": "object",
   "properties": {

schemas/diagnostics-result.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/diagnostics-result.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/diagnostics-result.schema.json",
   "title": "diagnostics-result",
   "type": "object",
   "properties": {

schemas/display-metadata.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/display-metadata.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/display-metadata.schema.json",
   "title": "display-metadata",
   "type": "object",
   "properties": {

schemas/document-symbol-tree.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/document-symbol-tree.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/document-symbol-tree.schema.json",
   "title": "document-symbol-tree",
   "type": "array",
   "items": {

schemas/error.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/error.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/error.schema.json",
   "title": "error",
   "type": "object",
   "properties": {

schemas/folding-ranges.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/folding-ranges.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/folding-ranges.schema.json",
   "title": "folding-ranges",
   "type": "array",
   "items": {

schemas/formatting-options.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/formatting-options.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/formatting-options.schema.json",
   "title": "formatting-options",
   "type": "object",
   "properties": {

schemas/generation-receipt.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/generation-receipt.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/generation-receipt.schema.json",
   "title": "generation-receipt",
   "type": "object",
   "properties": {

schemas/generation-report.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/generation-report.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/generation-report.schema.json",
   "title": "generation-report",
   "type": "object",
   "properties": {

schemas/inlay-hints.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/inlay-hints.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/inlay-hints.schema.json",
   "title": "inlay-hints",
   "type": "array",
   "items": {

schemas/job-artifact-content.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/job-artifact-content.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/job-artifact-content.schema.json",
   "title": "job-artifact-content",
   "type": "object",
   "properties": {

schemas/job-capabilities.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.0/schemas/job-capabilities.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.2.1/schemas/job-capabilities.schema.json",
   "title": "job-capabilities",
   "type": "object",
   "properties": {