Skip to content

VoucherBot v1.0.3

Choose a tag to compare

View all tags
@Devathmaj Devathmaj released this 12 Aug 15:46
· 39 commits to main since this release
v1.0.3
b1b01c7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.3 — Hardening & Reliability

Patch release: additional security hardening, CI hardening, and first-startup/database reliability fixes.

Security

  • URL validation & feed content-type checks — collectors reject mismatched content types and malformed/unsafe URLs
  • Trustworthy rate-limit keys — limiter keys keyed on a stable, bounded representation instead of raw client strings; bounded limiter cache to prevent unbounded growth
  • Broader query redaction — sensitive query parameters redacted from logs, including exception strings
  • Rate limiter hardening — exception messages redacted in logs

CI / Supply chain

  • OIDC scoped to docker job — least-privilege token issuance
  • cosign pinned to commit SHA — supply-chain pin for the signer installer
  • Dropped unsupported Resend tracking params — email config cleanup
  • Cosign signing of published Docker images

Reliability

  • Enum migration on fresh DB — runs on an explicit autocommit connection and skips gracefully when the \sourcetype\ type does not exist yet (previously failed with a poisoned transaction)
  • Async connection started properly — fixed \AsyncContextNotStarted\ by entering \engine.connect()\ as an async context before applying connection options
  • vendor_mappings unique constraints — added unique constraints on \url_pattern\ / \source_name_pattern\ so \ON CONFLICT\ upserts in bootstrap target existing indexes (matches migrations)

Testing

  • New tests for DB init (enum migration paths), collector URL/content-type guards, email sender, and rate limiting

  • uff check,
    uff format --check, and \mypy voucherbot tests\ all clean
  • Full suite passes

Full Changelog: v1.0.2...v1.0.3

Assets 2
Loading