Skip to content

v0.2.0 — Pre-release hardening

Choose a tag to compare

View all tags
@fdff87554 fdff87554 released this 29 Apr 07:55
· 321 commits to main since this release
v0.2.0
861036a

Highlights

Pre-release hardening based on code review feedback (#11). 29 atomic commits across reproducibility, security, functional correctness, operability, and developer experience.

  • Reproducibility: uv-generated lockfiles for the backend; yt-dlp pinned to 2026.3.17; pinned base image patch versions.
  • Security: per-IP rate limiting (slowapi + nginx limit_req), nginx security headers (CSP / X-Frame-Options / etc.), non-root container, mandatory ALLOWED_ORIGINS in production, masked yt-dlp errors when DEBUG=false, frontend npm audit clean.
  • Functional correctness: Deno bundled into the runtime image so yt-dlp can solve YouTube JS challenges (full format coverage); quality fallback now respects the requested height ceiling.
  • Operability: Docker HEALTHCHECK; entrypoint signal trap so docker stop is graceful; subprocess stderr forwarded to logger and return-code monitored.
  • CVE patches: starlette CVE-2025-62727 (via fastapi>=0.121,<0.124), pytest CVE-2025-71176, vite / postcss audit fixes.
  • Dev experience: full README, MIT LICENSE, LEGAL.md, CI security audits (npm audit + pip-audit), CI dependency caching, vitest with frontend tests.

Breaking changes

  • ALLOWED_ORIGINS must be set when DEBUG=false; compose.yaml no longer defaults to *.
  • GET /api/formats removed; the same data is on GET /api/info (formats field).
  • Uvicorn now boots via --factory app.main:create_app instead of app.main:app.

Pull the image

docker pull ghcr.io/fdff87554/youtube-downloader:0.2.0
# or, for the floating minor tag:
docker pull ghcr.io/fdff87554/youtube-downloader:0.2

Run with the new mandatory configuration:

docker run -d \
  -p 8080:8080 \
  -e ALLOWED_ORIGINS="https://your-frontend.example.com" \
  --name youtube-downloader \
  ghcr.io/fdff87554/youtube-downloader:0.2.0

For local exploration, use DEBUG=true instead of ALLOWED_ORIGINS. See the README for the full configuration reference and LEGAL.md for the usage notice.

Verify

curl http://localhost:8080/api/health
# -> {"status":"ok"}
Assets 2
Loading