)]}'
{
  "commit": "5af9af39319a813bcb0669b9c839bb776fe09d2d",
  "tree": "f5f5193aacc8ee0113239f710faf8f3b38c00188",
  "parents": [
    "856499c155f04c4f1b7d41dc702906dc68876a7b"
  ],
  "author": {
    "name": "Angel Adetula",
    "email": "angeladetula@google.com",
    "time": "Mon May 18 15:44:16 2026 +0000"
  },
  "committer": {
    "name": "Angel Adetula",
    "email": "angeladetula@google.com",
    "time": "Mon May 18 09:48:04 2026 -0700"
  },
  "message": "cos-extensions: prevent path traversal in module download\n\nImplements path validation to ensure the downloaded module path is\nalways within the intended local directory. This mitigates a\npotential vulnerability where a crafted module name could cause\nwrites outside the target directory.\n\nBUG\u003db/507259567\nTEST\u003dbuilt cos-extensions and tested on image, cloudbuild\n\nChange-Id: I6e432b9a43f05234c629e3a3b9f001ad8a2f5baf\nReviewed-on: https://cos-review.googlesource.com/c/cos/cos-extensions/+/152503\nTested-by: Angel Adetula \u003cangeladetula@google.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a37e3d5937c1372872b97a4f8cc6a2eaecf2d44a",
      "old_mode": 33188,
      "old_path": "tools/gcs/gcs.go",
      "new_id": "29b937f7fc646031ce35bc0647d27be4361667cf",
      "new_mode": 33188,
      "new_path": "tools/gcs/gcs.go"
    },
    {
      "type": "modify",
      "old_id": "176d00e387cec256c11aef7da889b45fffff1ca2",
      "old_mode": 33188,
      "old_path": "tools/gcs/gcs_test.go",
      "new_id": "2b5c0113daa8979e60744d530591798d3060ca4e",
      "new_mode": 33188,
      "new_path": "tools/gcs/gcs_test.go"
    }
  ]
}