v1.48.1

Changed

• The client IP source presets a site can use are now a fixed list of the eight the dashboard offers (Direct, Cloudflare, AWS, Google Cloud, Azure, Vercel, nginx, Development) rather than whatever the underlying library happens to ship. A preset decides which forwarding headers are believed, so admitting one is a security decision rather than something a dependency update should make. A stored value outside the list falls back to Direct, which believes no forwarding header.
• The origin signature covers the path the origin actually receives, including the origin's own path prefix. Origins without a path prefix are unaffected, because that path is unchanged. See docs/ACCESS_LISTS.md.

Fixed

• Origins configured with a path prefix, for example http://app:3000/api, can now verify the BurrowGate signature. The signed value previously covered the public path, so it never matched what such an origin computed and every request was rejected.
• A WebSocket upgrade that fails over to a second origin is now signed for that origin, so failover to an origin with a different path prefix verifies instead of being refused.