v1.0.8

NetWatch v1.0.8

Security

• Hardened SubDL subtitle downloads against server-side request forgery.
• Added manual redirect validation for subtitle downloads.
• Added DNS pinning for validated subtitle download hosts.
• Prevented SubDL API credentials from being forwarded across redirect origins.
• Rejected private, loopback, and otherwise unsafe redirect destinations.
• Hardened torrent storage paths so runtime save directories are generated internally instead of being derived from request-controlled values.
• Added bounds and escaping for dynamic season and episode regex inputs.
• Replaced TMDB image filename regex validation with fixed length, character, and extension checks.
• Added CodeQL suppression for sanitized setup-state logging that does not expose credential values.

Fixed

• Fixed remaining unsafe redirect handling in SubDL download paths.
• Fixed CodeQL path-traversal findings by removing request-derived torrent save-directory names.
• Fixed regex-injection and regex-complexity findings in metadata handling.

Internal

• Added regression tests for private-address subtitle redirects.
• Added regression tests confirming SubDL credentials are stripped on cross-origin redirects.
• Added regression coverage for generated torrent save directories.
• Added metadata validation coverage for bounded season, episode, and image inputs.
• Application version updated to 1.0.8.
• Runtime marker updated to 1.0.8-pkg40.