Skip to content

v1.1.1 — security fixes

Latest
Latest

Choose a tag to compare

View all tags
@MUKE-coder MUKE-coder released this 06 Oct 04:33
v1.1.1
3f8c985

Security fixes for two reported issues.

Security

  • Hidden tables are now enforced on the raw SQL editor (#9). A TablePolicy.Hidden table was omitted from the schema and 404'd on the browse routes, but POST /api/sql could still SELECT from it. The SQL editor now refuses (403) any statement that names a hidden table — a conservative, fail-closed whole-word match.
  • Crafted Excel imports can no longer panic the request (#8, GO-2026-6452). XLSX parsing is wrapped in a recover, so a malformed file that trips the underlying library's panic returns a clean error instead of a 500 with a stack trace.

CI

  • Pinned golangci-lint to v1.64.8 for reproducibility (latest moved to v2.x, which changes the enabled linters and would break lint on unchanged code).

Full changelog: https://github.com/MUKE-coder/gorm-studio/blob/main/CHANGELOG.md

Assets 2
Loading