Skip to content

v0.30.2

Choose a tag to compare

View all tags
@bigcat88 bigcat88 released this 02 Jun 09:05
· 18 commits to refs/heads/main since this release
v0.30.2
9058723

Changed

  • download_directory_as_zip: the order of entries inside the returned archive is no longer guaranteed; it now depends on the Nextcloud server's database backend, after Nextcloud server #60225 removed the implicit ORDER BY name ASC. #429

Security

  • Pinned starlette>=1.0.1 to address BadHost (CVE-2026-48710): a crafted Host header could desync request.url.path from the routed path in Starlette ≤ 1.0.0, bypassing path-based authorization. FastAPI does not constrain Starlette's upper bound, so an explicit floor is required to guarantee the fix. The fastapi floor was also raised to >=0.133 (the first release compatible with Starlette 1.0+).
Assets 2
Loading