A maintenance release. No new capability worth a minor bump, but enough security and correctness work that it should not wait for 2.9.
Security
A webhook could still be sent to a host that refused to resolve. The guard checks every address a hostname resolves to and blocks the private ones, but an unresolvable hostname fell through and the request went out anyway. That branch existed only so two delivery tests aiming at hooks.example.com would pass — the production behaviour was a side effect of the tests. It leaves a rebinding window: answer NXDOMAIN while the check runs, resolve to an internal address by the time requests looks it up again. Any refusal from the resolver now stops the send.
The container ran everything as root. It creates uid 1000 and drops to it. If you bind-mount ./results from a directory owned by someone else, run chown -R 1000:1000 results on the host. CI now checks the image is unprivileged and can still write to all four data directories.
Leaflet came off unpkg with no integrity attribute — the map page trusted whatever the CDN served. Script and stylesheet now carry the sha256 hashes published on leafletjs.com.
numverify was called over plain HTTP, with the phone number and API key in the query string. HTTPS now, falling back only on error 105, the one case where the free plan itself refuses TLS.
Secret scanning, push protection and Dependabot security updates are on for the repository. That surfaced nine advisories nobody had seen; five are closed here.
Added
RDAP module (#306, by @sOuL2000s) — registration data over RDAP alongside WHOIS. Finds the server per TLD from the IANA bootstrap file, falls back to rdap.org, and returns registration dates, registrar, nameservers and contacts.
A keyboard shortcuts panel, tooltips on the standalone tool cards (#305), and multi-arch images on GHCR for linux/amd64 and linux/arm64 on every release tag.
CodeQL runs on pushes, pull requests and weekly. Stale handling touches pull requests only and leaves issues alone.
Fixed
RDAP reported 292 as the registrar. jCard properties are [name, params, type, value], so reading index 2 returned the type and every contact came back as "text". The registrar was read from the entity handle instead, which is the IANA registrar id, not a name. The test fixture used a three-element vCard, which real RDAP never sends, so nothing caught it.
Every .ru domain looked unregistered. A 404 from rdap.org was read as "not registered", but plenty of TLDs serve no RDAP at all. The zone is checked against the bootstrap map first and the module reports skipped.
A rate-limited request came back as a CORS error. add_middleware wraps from the inside out, so CORS ended up innermost and anything short-circuited above it answered without the headers — the browser hid the 429 behind an opaque network failure. CORS is outermost now, and proxy headers still run before the limiter, so the client IP behind a proxy is unchanged.
File work blocked the event loop in two routes. The metadata endpoint copied the whole upload to a temp file inline, and clearing scans read every file in scan_data inline. Both stalled every other request while they ran, websocket scan progress included.
The demo now says on the page, not just in the docs, that AI analysis will not work there.
Upgrading
docker pull ghcr.io/novacode37/prism-platform:2.8.1
Nothing to migrate. The one thing to know is the uid change above if you bind-mount a results directory.
326 → 343 tests.
