Not sure if this is the right place to report this, but these security
issues have been fixed since 2.0.11:
* Prevent shell injection attacks via constant interpolation in
command hooks. (This was already implemented for deprecated
"before_*"/"after_*" command hooks.)
* For the Healthchecks, Apprise, Pagerduty, and Loki monitoring hooks,
disable log sending when not explicitly enabled. This avoids
revealing private log information to third-party services. To send
logs anyway, set the monitoring hook's "send_logs" option to "true".
* (The following likely has no impact on Debian, which builds its own
package..) Upgrade the certifi dependency to remove trusted eMudhra
certificates, thereby addressing the eMudhra certificate authority
compromise. This affects outgoing HTTP requests made from borgmatic
monitoring hooks, and only applies to the precompiled borgmatic
binary (which bundles certifi).
As of this writing, the current release version is 2.2.0.
Dan
