Skip to content

v1.0.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 11:24
· 5 commits to main since this release
v1.0.2
4ee303c

Security

  • Escape Coolify-controlled strings (server and application names, fqdns,
    commit messages, HTTP error text) at every markup-capable sink — the bar
    label, tooltip, panel hero detail, server section headers, and the
    notification summary/body (the notification renderer treats the body as
    StyledText) — so a hostile commit message can never be interpreted as
    markup.
  • Cap HTTP response bodies at 5 MiB (bounded while streaming) and the
    config file at 1 MiB, so a misbehaving endpoint cannot drive unbounded
    memory use. open --url additionally refuses URLs the URL crate does
    not parse as http/https.

Artifact: coolify-qs-1.0.2-linux-x86_64.tar.gz (statically linked musl x86_64).

Assets 3
Loading