Sparkle security issue

[Fryguy]

See sparkle-project/Sparkle#720

All Sparkle versions older than 1.13.1 which fetch appcast or release notes over insecure HTTP connection are vulnerable to a man-in-the-middle attack that can lead to disclosure of local files or remote code execution.

Applications using Sparkle with HTTPS appcast feed URLs and HTTPS release notes links (if any) are safe.

From what I can tell, OpenEmu uses Sparkle 1.7.1, but I can't tell if it's using HTTP or HTTPS. Either way, I thought I'd raise up the issue here.

[clobber]

Thanks. We've used HTTPS since the beginning.

[Eitot]

@clobber: No plans to update to a newer version of Sparkle?