Skip to content

driftnet 1.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 00:01
· 3 commits to main since this release
v1.2.0
68cb302

Four security and reliability fixes from the November audit. Nothing to migrate.

What changed

  • Chat links no longer carry the share key. On a private catalogue every card link a bot, the MCP page_url or the feed hands out is now signed for that one card (/?card=<id>&s=…): it opens on a phone without a password and shows nothing else. The read-only share key never goes into a group any more. Old ?key= links keep working.
  • LINE answers before its reply token expires. A link that takes longer than 20 s (a video being read) gets "reading this one" with the reply token, and the card is pushed to the same chat when it is ready, Flex first with the plain-text fallback.
  • Model, embedding and judge calls go through the SSRF guard. DRIFTNET_LLM_BASE_URL / DRIFTNET_EMBED_BASE_URL pointed at the LAN or a cloud metadata address get nowhere. This machine (Ollama, LM Studio on localhost) always works; another private host needs the new DRIFTNET_LLM_ALLOW_LOCAL=1, and only that host is allowed.
  • yt-dlp: cookies and a stale-version warning. DRIFTNET_YTDLP_COOKIES names a cookies.txt exported from a logged-in browser, for Facebook/Instagram posts hidden from anonymous visitors and YouTube's "sign in to confirm you're not a bot". yt-dlp's version is checked at the first video; one older than four months is logged, and named again whenever a video cannot be read.

Upgrading

  • npm i -g driftnet@1.2.0 (or docker pull). Settings → AI has the new "Allow a model on your network" switch only if your model runs on another LAN machine; localhost needs nothing.

更新內容（繁體中文）

  • 聊天回覆不再帶分享碼。 私人目錄裡，機器人、MCP 的 page_url、feed 給出的每個卡片連結都只為那一張卡片簽章（/?card=<id>&s=…）：手機點開不用密碼，也看不到其他卡片。舊的 ?key= 連結仍可用。
  • LINE 在 reply token 過期前先回覆。 超過 20 秒（例如讀影片）先回「讀取中」，卡片好了再推播到同一個聊天室。
  • 模型、embedding、判讀端點都經過 SSRF 守門。 本機 localhost 一律可用；區網另一台機器要設 DRIFTNET_LLM_ALLOW_LOCAL=1，且只放行那一台。
  • yt-dlp 可設 cookies 檔，版本過舊會提醒。 DRIFTNET_YTDLP_COOKIES 指向從已登入瀏覽器匯出的 cookies.txt；yt-dlp 超過四個月舊時會在記錄裡提醒，影片讀不到時也會再提一次。

Full Changelog: v1.1.1...v1.2.0

Assets 2
Loading