Skip to content

v0.25.8

Choose a tag to compare

View all tags
@antybubbs antybubbs released this 31 Jul 08:07
· 109 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.25.8
9623f46
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • Corrected disabled-module dashboard coverage and Backup Manager permission-test setup, and repaired shared Wallboard redirect and cookie paths to use the validated public route token.

Security

  • Upgraded cryptography from 48.0.1 to 49.0.0. Kaya does not use the raw "ChaCha20" API affected by the release's nonce/counter compatibility change; its direct cryptographic integrations continue to use Fernet, AES-GCM, Scrypt/HKDF, Ed25519, and RSA without changing stored ciphertext or key formats. The upstream platform changes remove 32-bit Windows and Intel macOS wheels; Kaya's supported Python 3.12 Linux container remains supported.
  • Remediated CVE-2026-48710 by pinning Starlette 1.3.1. This release contains the upstream malformed Host header fix introduced in Starlette 1.0.1 and later fixes for StaticFiles path validation, URL authority parsing, and form parser resource limits.
  • Added the stable HTTPX2 test-client dependency required by Starlette 1.3.1. FastAPI remains at 0.136.3 because its published dependency metadata officially supports Starlette 1.3.1 (starlette>=0.46.0); Kaya's existing Pydantic Settings 2.14.2, HTTPX 0.28.1, and Uvicorn 0.34.0 pins remain within their declared compatibility constraints.
  • Added direct and trusted-reverse-proxy regression coverage for authentication, authorisation, module access, CSRF, redirects, WebSockets, static files, file uploads, and malformed or manipulated Host headers.

Full Changelog: v0.25.7...v0.25.8

Assets 3
Loading