Skip to content

DarwinRelay 0.6.1

Choose a tag to compare

View all tags
@dcierra dcierra released this 19 Aug 11:20
· 23 commits to main since this release
v0.6.1
f4d0bce
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

DarwinRelay 0.6.1

Security-hardening patch release following the first public CodeQL cycle.

Security and transport hardening

  • HTTP/OAuth request-body failures no longer serialize arbitrary internal exception text to remote callers; detailed diagnostics stay local.
  • Bridge child-process failures return fixed public 500/503/504 messages instead of exposing exit details, local paths or runtime state.
  • Optional OAuth client_secret comparison now uses a bounded fixed-size constant-time representation without persisting or hashing the secret.
  • Cloudflare Quick Tunnel discovery now parses and validates URL components and host labels structurally instead of matching a URL substring with a regex.
  • OAuth consent tests now assert the exact validated redirect destination rather than substring presence.

OSS security automation

  • Added CodeQL v4 analysis for JavaScript/Node and Swift.
  • Added SwiftPM metadata so all native Swift targets can be extracted deterministically by CodeQL.
  • JavaScript CodeQL runs on pull requests; the heavier Swift scan runs on main, weekly schedules and manual dispatch.
  • Added weekly Dependabot monitoring for GitHub Actions and npm metadata.
  • main now requires the aggregate CodeQL security check in addition to the four existing CI checks.

Validation

The security-fix source passed:

  • all four public CI jobs;
  • the full local regression suite, including native AppKit E2E and lifecycle tests;
  • JavaScript CodeQL with zero branch-level alerts;
  • Swift CodeQL with zero branch-level alerts on the exact security-fix head.

DarwinRelay remains intentionally powerful and is not a sandbox. Read SECURITY.md before exposing the HTTP transport remotely.

Assets 2
Loading