Skip to content

v2.2.6 - Comprehensive Codebase Review

Choose a tag to compare

View all tags
@chtugha chtugha released this 07 Jun 12:51
· 8 commits to master since this release
v2.2.6
fe4e472

Security Fixes

  • Critical: Fixed SHA256 salt parameter being ignored in authentication - passwords are now properly salted
  • Added backward-compatible hash migration for existing users (auto-migrates on next login)
  • Added HttpOnly, SameSite=Lax, and Path attributes to authentication cookies

Dependency Updates

  • gorilla/websocket v1.4.2 → v1.5.3
  • go-ssdp v0.0.2 → v0.9.0
  • golang.org/x/net v0.52.0 → v0.55.0
  • golang.org/x/sys v0.42.0 → v0.45.0

Code Quality

  • Fixed deprecated websocket API usage
  • Removed all invalid JSON struct tag options
  • Removed unused dead code functions
  • Fixed error string conventions per Go standards
  • Replaced numeric HTTP status codes with constants
  • Removed redundant returns and unnecessary fmt.Sprintf calls
  • Fixed error handling for file permission changes
  • Fixed typo in timeout error string
  • All staticcheck, go vet, and go build pass cleanly with zero warnings
Assets 8
Loading