v1.4.2

fogwall 1.4.2

This is a security patch release. Any deployment with secret scanning enabled should upgrade — the default developer push workflow is otherwise unchanged.

Security

• Secret-scan subprocesses no longer inherit fogwall's full environment — GitleaksRunner spawned gitleaks (and the git child it invokes via gitleaks git) with the parent process's complete environment, so every env-sourced secret in fogwall's configuration (database password, provider API tokens, OIDC client secret, LDAP/AD bind passwords) was readable by that subprocess. This mattered more than a typical subprocess because the scanner binary can be downloaded and unpacked by fogwall at runtime when commit.secret-scanning.auto-install is enabled, so the process reading the environment could be third-party code fetched at startup. Each subprocess (the diff scan, the git-mode scan, the object-visibility preflight, and the PATH probe) now gets an explicit environment built from an allowlist (PATH, HOME, TMPDIR, locale variables) instead of the inherited one. Scope is the secret-scanning path only — a deployment that does not enable it is unaffected. (#672)

Bug fixes

• A YAML anchor/alias resolving to a list failed to load — a config value shared across sections via a YAML anchor now resolves correctly instead of failing at startup. (#673)

Upgrade

1. Pull the 1.4.2 image (or 1.4/latest, which now point at this release).
2. No configuration changes and no database migration — restart with the new image.

Full Changelog: v1.4.1...v1.4.2