- Fixed the URL of the security advisory linked from the documentation.
- Full fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27:
- Deprecates quote APIs in favor of
try_
equivalents that complain about nul bytes. - Also adds a builder API, which allows re-enabling nul bytes without using the deprecated interface, and in the future can allow other things (as discussed in quoting_warning).
- Adds documentation about various security risks that remain, particularly with interactive shells.
- Deprecates quote APIs in favor of
- Adds explicit MSRV of 1.46.0.
- Partial fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27 without bumping MSRV:
- The bytes
{
and\xa0
are now escaped by quoting functions.
- The bytes
- Adds
bytes
module to support operating directly on byte strings.
- Adds the
std
feature (enabled by default). - Disabling the
std
feature makes the crate work in#![no_std]
mode, assuming presence of thealloc
crate.
- Adds the
join
convenience function. - Fixes parsing of
'\\n'
to match the behavior of bash/Zsh/Pythonshlex
. The result was previously\n
, now it is\\n
.
- Adds handling of
#
comments.
This is the initial release.