v2.10.0

v2.10.0 – Security hardening: SSRF protection, safer image handling, and stricter validation

This release focuses on security. It adds SSRF protection to all server-side URL fetching, validates fetched images by their actual bytes and serves them safely against content-sniffing XSS, enforces stricter item/tag ID validation, and upgrades the runtime to PHP 8.5. It also fixes a password-update bug and includes a few environment and layout tweaks.

Security

• SSRF protection (CWE-918) — Server-side URL and image fetching now validates the destination and blocks requests to internal, private, loopback, and cloud-metadata addresses. See advisory GHSA-73cp-25jp-rx87. Reported by @456789TZ.
• Safer image handling – Fetched images are verified by magic-byte sniffing rather than the remote Content-Type, restricted to a defined image allowlist (SVG excluded as a script vector), and served with X-Content-Type-Options: nosniff to prevent content-sniffing XSS.
• Stricter ID validation – Item and tag IDs are now consistently validated as positive integers across endpoints, closing path-traversal and malformed-input vectors.

Updated

• Metadata extraction now validates the fields it pulls from a page and fails clearly when a page can't be parsed.
• Reordered the tags and notes fields in the item edit form.

Fixed

• Fixed a broken updatePasswordHash call in the login flow.

Under the hood

• Upgraded the Docker base image to PHP 8.5-apache (also refreshes the container's CA certificates for TLS verification).
• Centralized image media-type rules into a single Image class and simplified HTTP response validation to rely on content sniffing.
• Declared required PHP extensions (ext-curl, ext-fileinfo) in composer.json.
• Development Docker Compose services now use the unless-stopped restart policy.

Full Changelog: v2.9.1...v2.10.0