🔒 Security Hardening: Credential Protection
Sensitive information just got more secure. This release removes filesystem paths from basic auth error messages to prevent inadvertent disclosure in logs and UI, patches a known vulnerability in network module dependencies, and improves debug logging clarity for multi-host setups. No configuration changes are required—existing deployments continue to work without any modifications.
What's New
- Credential Path Redaction: Basic auth errors no longer expose the filesystem path of password files. Path information is now only emitted at debug log level, preventing inadvertent disclosure of sensitive configuration details.
- CVE-2026-25680 Mitigation: Updated
golang.org/x/netto v0.57.0 alongside other indirect Go module dependencies to address a known vulnerability. - Improved Multi-Host Logging: Startup logs now report the number of loaded Traefik host instances, and debug YAML dumps produce clean effective configuration without redundant legacy notation.
How to Use
No configuration changes required—just pull the latest image!
docker pull ghcr.io/dannybouwers/trala:v0.17.1
# or
docker pull dannybouwers/trala:v0.17.1What's Changed
- 🔧 chore(deps): update Go module dependencies by @dannybouwers in #162
- 🐛 fix(config): remove password file path from basic auth errors by @dannybouwers in #163
- Improve multi-host logging and YAML serialization by @dannybouwers in #164
Full Changelog: v0.17.0...v0.17.1
Contributors
dannybouwers