Skip to content

v1.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 21:57
· 4 commits to main since this release
v1.1.1
42d1a18

Changes since v1.1.0

Fixes

  • fix(security): serve stored bytes under the type the server recorded (f4b9f3c)
  • fix(security): stop shipping a localhost auth URL to browsers (575677d)
  • fix(security): hide items shared with a former workspace member (dec5fbf)
  • fix(security): require Secure session cookies in production (c581749)
  • fix(security): keep the tightened headers from breaking previews (35188fd)
  • fix(security): sandbox PDF previews, tighten markdown sanitising, document env (e88974c)
  • fix(security): sweep stale rate limit rows (4a003ee)
  • fix(security): stop logging OTPs and require a verified email to self-promote (b55cbe6)
  • fix(security): confirm organization membership before joining a team workspace (6613586)
  • fix(security): add a nonce-based CSP and validate the session in the shell (2ad5285)
  • fix(security): validate avatar bytes and trust stored item types (814cfc1)
  • fix(security): close the archive and upload paths around MIME and quota rules (01c7c11)
  • fix(security): reject unsafe item names and neutralise zip entry paths (0967f1b)
  • fix(security): keep internal shares under the item owner's control (4d717b3)
  • fix(security): invalidate share unlock cookies when the password changes (fce62b7)
  • fix(security): stop trusting client proxy headers and compare the cron secret safely (368024d)

Other

  • ci: tag each green main push and list changes since the last release (42d1a18)
  • Remove the marketing site from the self-host repository. (6273be1)
  • Add a public marketing site and deploy it on Dokploy. (f1f068d)
  • Merge pull request #4 from AloneDay-91/cursor/security-audit-followups-8b18 (4406475)
  • Merge branch 'main' into cursor/security-audit-followups-8b18 (d75070e)
  • Add a Dokploy Compose file so production builds on the server. (556024f)
  • Merge pull request #3 from AloneDay-91/cursor/security-audit-hardening-8b18 (46d630a)
  • docs: document every runtime env var and bootstrap ADMIN_EMAILS (00e12b8)

What's Changed

  • Audit de sécurité : durcissement de l'authz, des partages, des uploads et des en-têtes by @AloneDay-91 in #3
  • Sécurité : le type de contenu servi depuis le stockage était choisi par le client by @AloneDay-91 in #4

Full Changelog: v1.1.0...v1.1.1

Contributors

AloneDay-91
Assets 2
Loading