Skip to content

v3.3.0

Choose a tag to compare

View all tags
@syswave-dev syswave-dev released this 08 Jul 15:27
· 37 commits to main since this release
v3.3.0
9644889
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Block Server-Side Request Forgery (SSRF) (closes #41). The URL-fetch endpoints now resolve the target host and deny any request to private, loopback, link-local, CGNAT, or cloud-metadata address ranges (IPv4 and IPv6, including NAT64/6to4 embeddings). Every redirect hop is re-validated, and blocked requests return HTTP 403 before the cache is consulted. The guard covers the web fetch, Reddit short-link resolution, and the headless-browser sidecar dispatch.
  • Self-hosters who intentionally fetch internal hosts can allowlist specific CIDRs and/or hostnames via PULLMD_ALLOWED_HOSTS. Default is deny-all-internal; there is no global kill-switch.
  • Behind an outbound HTTP proxy, the proxy's egress rules are the authoritative layer.

Full changelog: see CHANGELOG.md.

Assets 2
Loading