Skip to content
This repository was archived by the owner on Aug 25, 2026. It is now read-only.

EdgeBase 0.3.5

Choose a tag to compare

View all tags
@melodysdreamj melodysdreamj released this 08 Jul 20:49
· 61 commits to main since this release
v0.3.5
1efbdbc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security & correctness hardening across the stack, plus the local-first SecretBox/DurableOutbox SDK primitives.

Security

  • Realtime rooms: reject forged anonymous auth — gated behind auth.anonymousAuth, isAnonymous forced, client-supplied role/email dropped (rules that must exclude anonymous actors should check auth.isAnonymous).
  • Database: escape schemaless column identifiers (SQL identifier injection).
  • Auth: admin login rate-limit + constant-time email handling; OAuth redirect wildcard host-suffix fix + a release-mode warning when auth.allowedRedirectUrls is unset; a valid Service Key (not mere header presence) is now required to bypass CAPTCHA; TOTP replay protection and MFA-ticket brute-force limits.
  • CORS: credentials are only sent on an exact-origin match (no more credentialed wildcard reflection).
  • Storage: key validation (path traversal / empty keys) on read/HEAD/delete/metadata paths.
  • Infra: cf-connecting-ip no longer trusted behind a self-hosted proxy; bounded rate-limit group for realtime broadcast/subscribe; DatabaseLiveDO subscriptions survive hibernation.

SDKs

  • JS: single-flight token refresh; SecretBox value-at-rest sealing with AAD binding + versioned format, atomic key creation, PBKDF2 600k; DurableOutbox + RecordCache fixes.
  • Swift/Python/Kotlin/Go: room reconnect loops, logout/refresh race + callback-deadlock fixes (Swift), unified token-expiry semantics, no auto-retry of non-idempotent POSTs.

Admin, CLI & infra

  • Admin: pinned API-docs bundle with token isolation, confirmed bulk deletes, datetime round-trip, CSV formula-injection neutralization.
  • CLI: Cloudflare-token storage is opt-in, destructive pack/docker/export paths are guarded, secrets kept off argv.
  • Docker image runs the server as a non-root user; CI actions pinned to commit SHAs.

Full changelog: v0.3.3...v0.3.5

Assets 2
Loading