| Version | Supported |
|---|---|
| 4.0.x | ✅ |
| < 4.0 | ❌ |
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure. If you cannot use Tidelift, email gaborjbernat@gmail.com.
Repository navigation
Security: tox-dev/filelock
Security
.github/SECURITY.md
-
ReadWriteLock on Windows acts on SQLite side files another local user places beside its databaseGHSA-9vhv-jxww-xfm5 published
Oct 17, 2026 by gaborbernatLow -
On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breakGHSA-567q-5qvw-pf92 published
Oct 17, 2026 by gaborbernatLow -
SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordGHSA-fj95-fr6c-h845 published
Oct 17, 2026 by gaborbernatModerate -
StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesGHSA-m462-7rxw-wvpg published
Oct 17, 2026 by gaborbernatModerate -
StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdGHSA-6627-m3xw-93mp published
Oct 17, 2026 by gaborbernatModerate -
Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerGHSA-9j6q-wvj5-jgjg published
Oct 17, 2026 by gaborbernatLow -
WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLGHSA-8mx5-7m5m-r77g published
Oct 17, 2026 by gaborbernatModerate -
ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutGHSA-cwqr-hh33-gh44 published
Oct 17, 2026 by gaborbernatModerate -
SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directoryGHSA-crv4-6mhj-j5jh published
Oct 17, 2026 by gaborbernatModerate -
SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersGHSA-fq56-3cx3-fjxp published
Oct 17, 2026 by gaborbernatModerate
Learn more about advisories related to tox-dev/filelock in the GitHub Advisory Database