publish new versions (#3675)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

plugins/fs/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [2.7.0]
+
+- [`a934743b`](https://github.com/tauri-apps/plugins-workspace/commit/a934743b7307891cc028c0dea945113311ddf100) ([#3637](https://github.com/tauri-apps/plugins-workspace/pull/3637)) Added the `scopeDroppedPaths` plugin config option (`plugins > fs > scopeDroppedPaths` in `tauri.conf.json`). Set it to `false` to stop adding the paths dropped onto any window to the fs scope, which otherwise gives every webview with an fs permission access to them (directories recursively). Defaults to `true`, the current behaviour.
+- [`085a0283`](https://github.com/tauri-apps/plugins-workspace/commit/085a02835d1c3eab09f2804f7d7e29611c010a01) ([#3636](https://github.com/tauri-apps/plugins-workspace/pull/3636)) Fixed a panic on Android when a content provider returns no file descriptor for a `content://` URI (e.g. virtual files). The fs command now fails with an error instead.
+- [`f81f0447`](https://github.com/tauri-apps/plugins-workspace/commit/f81f0447cc8d5ce6b88cc72aede4b7324428a542) ([#3635](https://github.com/tauri-apps/plugins-workspace/pull/3635)) Fixed reading uncompressed Android assets (`$RESOURCE` files such as images or audio that are stored uncompressed in the APK) returning the bytes of the APK instead of the asset. Assets are now always read from a copy in the app cache, like compressed ones.
+- [`e03dca60`](https://github.com/tauri-apps/plugins-workspace/commit/e03dca60e7c9219e24095e8da46f775fc9137e76) ([#3628](https://github.com/tauri-apps/plugins-workspace/pull/3628)) `startAccessingSecurityScopedResource` and `stopAccessingSecurityScopedResource` now accept absolute paths on iOS, as documented, instead of silently doing nothing unless given a `file://` URL.
+- [`5de7ebfc`](https://github.com/tauri-apps/plugins-workspace/commit/5de7ebfc952c07f376b2c25f3789742071748d5a) ([#3634](https://github.com/tauri-apps/plugins-workspace/pull/3634)) **Security:** the `open` command no longer accepts a `customFlags` option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary `open(2)` flags (e.g. `O_TRUNC`) to files it may only read. `OpenOptionsExt::custom_flags` still works from Rust.
+- [`5e6c023a`](https://github.com/tauri-apps/plugins-workspace/commit/5e6c023a796a21594064d06421c3bad3cef0a470) ([#3626](https://github.com/tauri-apps/plugins-workspace/pull/3626)) `FileHandle.read` no longer allocates a buffer of the requested size up front: the length is capped to the rest of the file (64 MiB for files of unknown size), an allocation failure is reported as an error instead of aborting the app, and only the bytes that were read are sent back to the webview.
+- [`3a900017`](https://github.com/tauri-apps/plugins-workspace/commit/3a9000177cd2f51ec02096db89fc0be5d389be20) ([#3627](https://github.com/tauri-apps/plugins-workspace/pull/3627)) **Security:** the fs scope check now resolves symlinks in the ancestors of paths that do not exist yet, and resolves relative symlink targets against the link's directory instead of the process working directory. Previously a new file created below a symlinked directory inside the scope (`writeFile`, `mkdir`, `create`, `rename`, `copyFile`, ...) was written outside of the scope. Deny patterns now also apply to the path as given, so they can name a symlink, and a path whose symlinks cannot be resolved (e.g. a loop) is rejected.
+- [`77d00a4f`](https://github.com/tauri-apps/plugins-workspace/commit/77d00a4f54ba65a2ab04a25ba501cf704e25fe60) ([#3633](https://github.com/tauri-apps/plugins-workspace/pull/3633)) `FileHandle.seek` now rejects a negative offset with `SeekMode.Start` instead of seeking to a huge position.
+- [`5c144e74`](https://github.com/tauri-apps/plugins-workspace/commit/5c144e74663a34b593dd70da9fcb48b6a21270a1) ([#3631](https://github.com/tauri-apps/plugins-workspace/pull/3631)) Fixed `readTextFileLines` with a UTF-16 encoding splitting lines on a `0x0A 0x00` (LE) or `0x00 0x0A` (BE) byte sequence that is not aligned on a code unit, e.g. `ਗĀ`, which garbled every following line.
+- [`dcc8cb03`](https://github.com/tauri-apps/plugins-workspace/commit/dcc8cb032b3db46a1ec9d0023391071806451fb7) ([#3629](https://github.com/tauri-apps/plugins-workspace/pull/3629)) Fixed `writeFile` with a `ReadableStream` leaving the end of the previous contents in place when the new data is shorter. The file is now truncated first unless `append` is set, like when writing a buffer.
+
 ## [2.6.0]
 
 - [`97e865bc`](https://github.com/tauri-apps/plugins-workspace/commit/97e865bc138925ba29b102a9cb99d406ce1fe48e) ([#3623](https://github.com/tauri-apps/plugins-workspace/pull/3623)) Added an `options` parameter with `baseDir` to `size`, so relative paths can be measured, like the other functions and like the JSDoc example already showed. The Rust command already accepted it.