Releases: MarchSnow-1/midibridge-server
Releases · MarchSnow-1/midibridge-server
Release list
v1.1.0
v1.1.0 - 31 August 2026
🎉 New Features
- Security: Config-driven TLS support — wss/https when tls.cert+tls.key configured, validated synchronously at startup (SRV-S3)
54ac5eeby @MarchSnow-1
🐛 Bug Fixes
- IPv6 bind, Windows rename compat, config save rollback, authGuard shutdown, recursive key detection
5ca9337by @MarchSnow-1 - Security: WS auth failure counting with per-IP temporary bans against brute force (WS-7)
6682e67by @MarchSnow-1 - Ws: Per-client bounded ordered write queues with drop counters; make two-level MIDI drops observable (WS-4/M-3)
5d9d116by @MarchSnow-1 - Security: Add bind config option, startup exposure warnings, config validation and unknown-key warnings (SRV-S1b/S1c/I2)
d5f1ad4by @MarchSnow-1 - Robustness: Idempotent MidiReader.Stop with safe channel close order; wire autoReconnect config (SRV-M2'/M-5/M-1/SRV-M3')
753fe37by @MarchSnow-1 - Security: Replace hardcoded default password with cryptographically random first-run password (SRV-S1)
94f1256by @MarchSnow-1 - Robustness: Guard against go-logger permanent silence — writability probe, console fallback, dedup option builder (SRV-LOG1)
a594424by @MarchSnow-1 - Security: Validate WebSocket Origin — allow native clients and same-host only, block CSWSH (WS-6)
2e17c65by @MarchSnow-1 - Ws: Add SetReadLimit, server-side ping/read-timeout reaping and close-on-write-failure (WS-1/WS-2/WS-3)
b2708fdby @MarchSnow-1 - Security: Remove CORS wildcard and enforce allowlist/rate-limit before OPTIONS preflight (SRV-S2)
2fa0227by @MarchSnow-1 - Security: Lock-protected Auth access — read snapshot accessor and fully-locked changePassword (SRV-L3)
cffb495by @MarchSnow-1 - Misc: Sanitize MIDI device names in logs, report authenticated client count in /admin/status, correct midiVerbose doc comment
bf272f6by @MarchSnow-1 - Robustness: Create listeners synchronously in Start() and exit on listen failure to prevent phantom-alive (SRV-M1')
11f0098by @MarchSnow-1 - Robustness: Startup validation of IP allowlists with explicit warnings for invalid entries (SRV-IP1/IP2/L6/L7)
3e97351by @MarchSnow-1 - Robustness: Replace hand-rolled itoa with strconv.Itoa — fixes negative-value rendering and malformed ports (M-4)
c1db6ccby @MarchSnow-1 - Robustness: Cap rate limiter entry table with expiry cleanup and oldest-eviction (SRV-L5)
8a9745fby @MarchSnow-1 - Ws: Close auth-timeout race window with kicked flag decided under the client lock (WS-9)
c25a1f9by @MarchSnow-1 - Robustness: Bounded shutdown with 10s timeout and second-signal force-exit escape hatch (SRV-M4')
2fb6180by @MarchSnow-1 - Ws: Send standard close frames before server-initiated disconnects (WS-8)
1920937by @MarchSnow-1 - Security: Password policy — rune-count length check, minimum 8 characters, explicit 72-byte bcrypt cap (SRV-M3)
6157216by @MarchSnow-1 - Don't close MIDI channels on timeout, use atomic rename without Remove
8069db8by @MarchSnow-1 - Security: HTTP server timeouts and enforce GET on /admin/status (SRV-L4)
643acf4by @MarchSnow-1 - Ws: ReadHeaderTimeout for handshake phase and nil-guarded Stop on both servers (WS-10/WS-11)
237bd6aby @MarchSnow-1 - Security: Restrictive config file permissions (0600/0700) and atomic write via temp file + rename (SRV-M2/SRV-I1)
ec1476dby @MarchSnow-1 - Security: Unify change-password error responses — no internal error leakage, remove old-password probing oracle (SRV-L1/L2)
938bb05by @MarchSnow-1 - Ws: Replace whole-map reset with per-client delete in KickAllClients to prevent orphaned connections (WS-5)
c94543fby @MarchSnow-1 - Robustness: Use time.NewTicker instead of time.After inside readLoop select (M-2)
6344fadby @MarchSnow-1
📝 Documentation Changes
- Comprehensive documentation update — security chapter, TLS/network/tls config, WebSocket protocol reference, random initial password flow, Go version alignment, autoReconnect/midiVerbose documentation (DOC-SRV-S1/H1/H2/H3/M)
79881efby @MarchSnow-1 - Add Unreleased changelog entries for security and reliability fixes
0d284d4by @MarchSnow-1 - Add badges to README
5ae8659by @MarchSnow-1
🎨 Tidying of Code eg Whitespace
- Gofmt whole source tree (fix import indentation and CC-block alignment)
1fcc897by @MarchSnow-1
Full Changelog: v1.0.1...v1.1.0
Contributors
MarchSnow-1
Assets 8
v1.0.1
v1.1.0 - 31 August 2026
🎉 New Features
- Security: Config-driven TLS support — wss/https when tls.cert+tls.key configured, validated synchronously at startup (SRV-S3)
54ac5eeby @MarchSnow-1
🐛 Bug Fixes
- IPv6 bind, Windows rename compat, config save rollback, authGuard shutdown, recursive key detection
5ca9337by @MarchSnow-1 - Security: WS auth failure counting with per-IP temporary bans against brute force (WS-7)
6682e67by @MarchSnow-1 - Ws: Per-client bounded ordered write queues with drop counters; make two-level MIDI drops observable (WS-4/M-3)
5d9d116by @MarchSnow-1 - Security: Add bind config option, startup exposure warnings, config validation and unknown-key warnings (SRV-S1b/S1c/I2)
d5f1ad4by @MarchSnow-1 - Robustness: Idempotent MidiReader.Stop with safe channel close order; wire autoReconnect config (SRV-M2'/M-5/M-1/SRV-M3')
753fe37by @MarchSnow-1 - Security: Replace hardcoded default password with cryptographically random first-run password (SRV-S1)
94f1256by @MarchSnow-1 - Robustness: Guard against go-logger permanent silence — writability probe, console fallback, dedup option builder (SRV-LOG1)
a594424by @MarchSnow-1 - Security: Validate WebSocket Origin — allow native clients and same-host only, block CSWSH (WS-6)
2e17c65by @MarchSnow-1 - Ws: Add SetReadLimit, server-side ping/read-timeout reaping and close-on-write-failure (WS-1/WS-2/WS-3)
b2708fdby @MarchSnow-1 - Security: Remove CORS wildcard and enforce allowlist/rate-limit before OPTIONS preflight (SRV-S2)
2fa0227by @MarchSnow-1 - Security: Lock-protected Auth access — read snapshot accessor and fully-locked changePassword (SRV-L3)
cffb495by @MarchSnow-1 - Misc: Sanitize MIDI device names in logs, report authenticated client count in /admin/status, correct midiVerbose doc comment
bf272f6by @MarchSnow-1 - Robustness: Create listeners synchronously in Start() and exit on listen failure to prevent phantom-alive (SRV-M1')
11f0098by @MarchSnow-1 - Robustness: Startup validation of IP allowlists with explicit warnings for invalid entries (SRV-IP1/IP2/L6/L7)
3e97351by @MarchSnow-1 - Robustness: Replace hand-rolled itoa with strconv.Itoa — fixes negative-value rendering and malformed ports (M-4)
c1db6ccby @MarchSnow-1 - Robustness: Cap rate limiter entry table with expiry cleanup and oldest-eviction (SRV-L5)
8a9745fby @MarchSnow-1 - Ws: Close auth-timeout race window with kicked flag decided under the client lock (WS-9)
c25a1f9by @MarchSnow-1 - Robustness: Bounded shutdown with 10s timeout and second-signal force-exit escape hatch (SRV-M4')
2fb6180by @MarchSnow-1 - Ws: Send standard close frames before server-initiated disconnects (WS-8)
1920937by @MarchSnow-1 - Security: Password policy — rune-count length check, minimum 8 characters, explicit 72-byte bcrypt cap (SRV-M3)
6157216by @MarchSnow-1 - Don't close MIDI channels on timeout, use atomic rename without Remove
8069db8by @MarchSnow-1 - Security: HTTP server timeouts and enforce GET on /admin/status (SRV-L4)
643acf4by @MarchSnow-1 - Ws: ReadHeaderTimeout for handshake phase and nil-guarded Stop on both servers (WS-10/WS-11)
237bd6aby @MarchSnow-1 - Security: Restrictive config file permissions (0600/0700) and atomic write via temp file + rename (SRV-M2/SRV-I1)
ec1476dby @MarchSnow-1 - Security: Unify change-password error responses — no internal error leakage, remove old-password probing oracle (SRV-L1/L2)
938bb05by @MarchSnow-1 - Ws: Replace whole-map reset with per-client delete in KickAllClients to prevent orphaned connections (WS-5)
c94543fby @MarchSnow-1 - Robustness: Use time.NewTicker instead of time.After inside readLoop select (M-2)
6344fadby @MarchSnow-1
📝 Documentation Changes
- Comprehensive documentation update — security chapter, TLS/network/tls config, WebSocket protocol reference, random initial password flow, Go version alignment, autoReconnect/midiVerbose documentation (DOC-SRV-S1/H1/H2/H3/M)
79881efby @MarchSnow-1 - Add Unreleased changelog entries for security and reliability fixes
0d284d4by @MarchSnow-1 - Add badges to README
5ae8659by @MarchSnow-1
🎨 Tidying of Code eg Whitespace
- Gofmt whole source tree (fix import indentation and CC-block alignment)
1fcc897by @MarchSnow-1
Full Changelog: v1.0.1...v1.1.0
v1.0.1 - 19 May 2026
🎉 New Features
- Add millisecond precision to log timestamps
d438203by @MarchSnow-1 - Filter CC#120/123 from midiVerbose log output
931c5ccby @MarchSnow-1
♻️ Refactoring and Updates
- Fix Broadcast deadlock, add kick constants, remove server-side AllNotesOff
673f6faby @MarchSnow-1 - Use kickPasswordChanged constant in httpadmin.go
011dc12by @MarchSnow-1
🔧 Chores And Housekeeping
- Add LICENSE
7bdbf4dby @MarchSnow-1 - Fix import ordering in main.go
4ab3330by @MarchSnow-1 - Fix import ordering in config.go
59d72f2by @MarchSnow-1 - Fix import ordering in auth.go
57db934by @MarchSnow-1
Full Changelog: v1.0.0...v1.0.1
Contributors
MarchSnow-1
Assets 8
v1.0.0
v1.1.0 - 31 August 2026
🎉 New Features
- Security: Config-driven TLS support — wss/https when tls.cert+tls.key configured, validated synchronously at startup (SRV-S3)
54ac5eeby @MarchSnow-1
🐛 Bug Fixes
- IPv6 bind, Windows rename compat, config save rollback, authGuard shutdown, recursive key detection
5ca9337by @MarchSnow-1 - Security: WS auth failure counting with per-IP temporary bans against brute force (WS-7)
6682e67by @MarchSnow-1 - Ws: Per-client bounded ordered write queues with drop counters; make two-level MIDI drops observable (WS-4/M-3)
5d9d116by @MarchSnow-1 - Security: Add bind config option, startup exposure warnings, config validation and unknown-key warnings (SRV-S1b/S1c/I2)
d5f1ad4by @MarchSnow-1 - Robustness: Idempotent MidiReader.Stop with safe channel close order; wire autoReconnect config (SRV-M2'/M-5/M-1/SRV-M3')
753fe37by @MarchSnow-1 - Security: Replace hardcoded default password with cryptographically random first-run password (SRV-S1)
94f1256by @MarchSnow-1 - Robustness: Guard against go-logger permanent silence — writability probe, console fallback, dedup option builder (SRV-LOG1)
a594424by @MarchSnow-1 - Security: Validate WebSocket Origin — allow native clients and same-host only, block CSWSH (WS-6)
2e17c65by @MarchSnow-1 - Ws: Add SetReadLimit, server-side ping/read-timeout reaping and close-on-write-failure (WS-1/WS-2/WS-3)
b2708fdby @MarchSnow-1 - Security: Remove CORS wildcard and enforce allowlist/rate-limit before OPTIONS preflight (SRV-S2)
2fa0227by @MarchSnow-1 - Security: Lock-protected Auth access — read snapshot accessor and fully-locked changePassword (SRV-L3)
cffb495by @MarchSnow-1 - Misc: Sanitize MIDI device names in logs, report authenticated client count in /admin/status, correct midiVerbose doc comment
bf272f6by @MarchSnow-1 - Robustness: Create listeners synchronously in Start() and exit on listen failure to prevent phantom-alive (SRV-M1')
11f0098by @MarchSnow-1 - Robustness: Startup validation of IP allowlists with explicit warnings for invalid entries (SRV-IP1/IP2/L6/L7)
3e97351by @MarchSnow-1 - Robustness: Replace hand-rolled itoa with strconv.Itoa — fixes negative-value rendering and malformed ports (M-4)
c1db6ccby @MarchSnow-1 - Robustness: Cap rate limiter entry table with expiry cleanup and oldest-eviction (SRV-L5)
8a9745fby @MarchSnow-1 - Ws: Close auth-timeout race window with kicked flag decided under the client lock (WS-9)
c25a1f9by @MarchSnow-1 - Robustness: Bounded shutdown with 10s timeout and second-signal force-exit escape hatch (SRV-M4')
2fb6180by @MarchSnow-1 - Ws: Send standard close frames before server-initiated disconnects (WS-8)
1920937by @MarchSnow-1 - Security: Password policy — rune-count length check, minimum 8 characters, explicit 72-byte bcrypt cap (SRV-M3)
6157216by @MarchSnow-1 - Don't close MIDI channels on timeout, use atomic rename without Remove
8069db8by @MarchSnow-1 - Security: HTTP server timeouts and enforce GET on /admin/status (SRV-L4)
643acf4by @MarchSnow-1 - Ws: ReadHeaderTimeout for handshake phase and nil-guarded Stop on both servers (WS-10/WS-11)
237bd6aby @MarchSnow-1 - Security: Restrictive config file permissions (0600/0700) and atomic write via temp file + rename (SRV-M2/SRV-I1)
ec1476dby @MarchSnow-1 - Security: Unify change-password error responses — no internal error leakage, remove old-password probing oracle (SRV-L1/L2)
938bb05by @MarchSnow-1 - Ws: Replace whole-map reset with per-client delete in KickAllClients to prevent orphaned connections (WS-5)
c94543fby @MarchSnow-1 - Robustness: Use time.NewTicker instead of time.After inside readLoop select (M-2)
6344fadby @MarchSnow-1
📝 Documentation Changes
- Comprehensive documentation update — security chapter, TLS/network/tls config, WebSocket protocol reference, random initial password flow, Go version alignment, autoReconnect/midiVerbose documentation (DOC-SRV-S1/H1/H2/H3/M)
79881efby @MarchSnow-1 - Add Unreleased changelog entries for security and reliability fixes
0d284d4by @MarchSnow-1 - Add badges to README
5ae8659by @MarchSnow-1
🎨 Tidying of Code eg Whitespace
- Gofmt whole source tree (fix import indentation and CC-block alignment)
1fcc897by @MarchSnow-1
Full Changelog: v1.0.1...v1.1.0
v1.0.1 - 19 May 2026
🎉 New Features
- Add millisecond precision to log timestamps
d438203by @MarchSnow-1 - Filter CC#120/123 from midiVerbose log output
931c5ccby @MarchSnow-1
♻️ Refactoring and Updates
- Fix Broadcast deadlock, add kick constants, remove server-side AllNotesOff
673f6faby @MarchSnow-1 - Use kickPasswordChanged constant in httpadmin.go
011dc12by @MarchSnow-1
🔧 Chores And Housekeeping
- Add LICENSE
7bdbf4dby @MarchSnow-1 - Fix import ordering in main.go
4ab3330by @MarchSnow-1 - Fix import ordering in config.go
59d72f2by @MarchSnow-1 - Fix import ordering in auth.go
57db934by @MarchSnow-1
Full Changelog: v1.0.0...v1.0.1
v1.0.0 - 2026-05-15
🎉 New Features
- Initialize
87a6da0by @MarchSnow-1 - Implement NodeJS autochangelog
5dbfc05by @MarchSnow-1
Contributors
MarchSnow-1