Skip to content

v6.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 09:39
v6.0.0
f6885f3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

6.0.0 (2026-10-21)

⚠ BREAKING CHANGES

  • the client requires WebSSH2 server 5.1.0 or newer. Runtime config is read only from the JSON config block (<script type="application/json" id="webssh2-config">) that server 5.1.0 introduced. window.webssh2Config is no longer read, so older servers, and integrations that set that global from an inline script, get no injected config (socket path, host, header, auto-connect and so on). Upgrade the server to 5.1.0+ or write the JSON block instead.

Features

  • drop legacy inline config script, require server 5.1.0+ (#179) (12c300f), closes #160

Bug Fixes

  • ci: make audit gate fail closed on invalid allowlist reviewBy (#152) (22809ab)
  • client: remove debug globals from production builds (#177) (4bed1ba), closes #165
  • deps: bump vite to 8.1.6 for launch-editor advisories (#174) (2476838)
  • deps: remediate advisories, drop axe CLI and stylelint, gate audit (#150) (4a09fa2)
  • deps: upgrade solid-js to 1.9.16 and drop seroval overrides (#162) (048baa9)
  • terminal: prefix and sanitize remote-set tab titles (#175) (f44276b), closes #166

Security

This release fixes three security advisories. Upgrade to 6.0.0.

  • Credentials in the URL (GHSA-7gqv-f74c-wc87, moderate): password, privateKey and passphrase URL parameters are removed from the address bar once read, and URL query parameters are no longer copied into the Socket.IO handshake.
  • Socket endpoint origin (GHSA-qgpv-r594-4c6g, moderate): the client connects only to a Socket.IO endpoint on the page's own origin; a different host in the injected config is logged and ignored.
  • Dependency audit posture (GHSA-5ffp-x574-93gf, moderate): dev-dependency advisories are fixed (including the solid-js/seroval line), the CI audit gate is green, and SECURITY.md has a current assessment. The published bundle was not affected.

Also in this release

  • Tailwind CSS 4 (#169): styles migrated from Tailwind 3 with screenshot parity against the 3.x build. See the README for minimum browser versions.
  • SFTP downloads (#154): the 512 MiB cap is a hard limit whatever the server advertises, and downloads the user didn't request are no longer saved.
  • SFTP listings (#167): listings show at most 10,000 entries, long names are shortened on screen, and sorting is memoized.
  • Host-key import (#156): importing keys no longer silently replaces a pinned key; a conflict needs confirmation, and __proto__ entries are rejected.
  • Session log (#157): the localStorage log is size-capped and stops with a visible notice instead of throwing on quota errors.
  • Legacy config code removed (#164): unused legacy config functions were deleted.
  • Release tooling (#155, #159): fix-npm-tags.sh can't move latest to an older version, and workflows use least-privilege permissions and pass inputs through env:.

Upgrading

  • WebSSH2 server 5.1.0 or newer is required (see Breaking Changes). WebSSH2 server 6.0.0, released alongside, pins this version.

Artifact checksums (SHA-256)

Per-file hashes of the shipped browser bundle. Verify against
the npm-installed package or the attached zip; see SECURITY
docs ("Release artifact integrity") for how.

# webssh2_client v6.0.0 SHA-256 checksums
fc5b2c732ec136152bac70b2075dc9395bea92706b43fd20e394998c5ec72d04  client-public.zip
50d8776d59f0706b8c7b279b8eb496ecc27754f25258281754a67a9a9fa39373  public/client.htm
513db94f33e001bad70cc26aeac21a631254619e37644007b4fb4b2267bfb50d  public/favicon.ico
2401d217b7ab061369c9602e37b0ce68145145f6a94481d51bc8ec6fa1cb3fdf  public/webssh2-6770b07e.js
6800878ac758e24d128a1da7dc9656c7a71bd0f25a59008adf44b212b7cbc15c  public/webssh2-b56d0773.css
d38557c1dc992805ae7a9da2030d3776586d304241aedd17396a066d3e9f26ac  public/xterm-6b3fe10d.css
Assets 4
Loading