Skip to content

v0.32.1

Choose a tag to compare

View all tags
@ericgitonga ericgitonga released this 04 Sep 23:18
· 3 commits to main since this release
v0.32.1
3d53b3b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Security

  • Added import "server-only" to src/sanity/lib/client.ts (the private-dataset read client),
    matching the guard writeClient.ts already had. No active leak today (every current importer
    is a Server Component), but this closes the gap where a future accidental import into a
    Client Component would silently bundle SANITY_API_READ_TOKEN into the browser JS. Found in
    the #29 adversarial security audit.

Added

  • Full adversarial security audit report (closes #29): no Critical/High findings; 3 Medium
    findings each filed as their own follow-up issue (#108 register API validation, #109 rate
    limiting, #110 email-ownership verification), plus this release's one-line Low fix.

Full Changelog: v0.32.0...v0.32.1

Assets 2
Loading