)]}'
{
  "commit": "16995f47d427aa133bd608d0366d0e3ff6475d99",
  "tree": "d481bfeb54a4e3b1364205588b80aa6777d9b6c4",
  "parents": [
    "ed22a2ccb9136e7d92bf21886ea5515ea2ea3af0"
  ],
  "author": {
    "name": "Yun Peng",
    "email": "pcloudy@google.com",
    "time": "Mon Oct 05 13:23:41 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Oct 05 13:23:41 2026 +0200"
  },
  "message": "Fix presubmit and postsubmit path handling vulnerabilities (#2917)\n\nAddresses b/569811973.\n\n- `bcr_presubmit.py`: Uses `git diff -z` to parse quoted paths\ncorrectly, preventing a bypass of symlink validations.\n- `bcr_postsubmit.py`: Verifies that the resolved path of the\ndestination attestation file is contained within the expected output\ndirectory using `pathlib.Path.resolve()`, preventing arbitrary file\nwrites via malicious symlinks.",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "78425b0354636a45510768ca43ca2edf270840e1",
      "old_mode": 33261,
      "old_path": "buildkite/bazel-central-registry/bcr_postsubmit.py",
      "new_id": "489d7acf88f24b4bcbd7f6b350a2beb9107b9e89",
      "new_mode": 33261,
      "new_path": "buildkite/bazel-central-registry/bcr_postsubmit.py"
    },
    {
      "type": "modify",
      "old_id": "4c4ed78fd19635c55b462ca14405426931a7aff6",
      "old_mode": 33261,
      "old_path": "buildkite/bazel-central-registry/bcr_presubmit.py",
      "new_id": "cacd22aca603592ebdabea14563582cb6568c4a6",
      "new_mode": 33261,
      "new_path": "buildkite/bazel-central-registry/bcr_presubmit.py"
    }
  ]
}