Skip to content

v0.8.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Feb 09:30
· 6 commits to main since this release
v0.8.1
4076afd
This commit was signed with the committer’s verified signature.
CallMeGwei Andrew D. Anderson
GPG key ID: 14D6578646A52C91
Verified
Learn about vigilant mode.

Added

  • Test coverage: Email validation, SSRF prevention, auth/impersonation, feedback/crash endpoints, SDK token verification, service config CRUD, cross-org isolation, webhook error handling
  • Bruno API collection files for operator tag endpoints and metering service
  • Deserialize derive on metering event types for downstream consumption

Changed

  • Replaced jwt-simple with jsonwebtoken: Migrated from BoringSSL backend to ring backend, eliminating heavy build dependencies (cmake, golang, libclang) from Docker builds
  • Removed dead JWKS/first-party JWT code: Deleted speculative JwksCache, TrustedIssuer, and RSA handling that was never used (console uses API keys via proxy pattern)
  • Graceful Docker shutdown: Server now handles SIGTERM in addition to SIGINT, preventing force-kill (exit code 137) on docker stop
  • Removed internal/ from .dockerignore

Fixed

  • SSRF prevention: validate_webhook_url() now blocks IPv4-mapped IPv6 addresses, 0.0.0.0, ::, and 172.16-31.x DNS rebinding hostnames
  • Email validation: validate_email_format() rejects CRLF injection, null bytes, and enforces RFC 5321 length limits
  • Activation code request: Now validates email format before processing

Full Changelog: v0.8.0...v0.8.1

Assets 2
Loading