v0.30.6

Webhooks to a host on your own zone now come in through Cloudflare. There is no migration in this release.

Security

• Webhooks reach your own zone as anyone's requests do. A request from the Worker to another host on its own zone went straight to that host's origin, past the security settings in front of it, such as Access or the WAF. A webhook's URL is the choice of whoever owns a workspace, so the Worker now runs with the global_fetch_strictly_public compatibility flag, and such a request comes in through Cloudflare like anyone's. A URL naming Track's own host with a trailing dot is refused, as the host itself is. (#263)

If you run your own

• Deploy, and keep the flag. It is in wrangler.jsonc. If you keep compatibility flags of your own elsewhere, add global_fetch_strictly_public to them. Requests to GitHub and to sign-in providers elsewhere are unaffected, and a provider on your own zone served by a Worker on a Custom Domain is reached as before. One on your own zone behind Access or a WAF rule now meets those rules, as a request from anywhere else would.
• pnpm install no longer pulls in a flagged version of esbuild through drizzle-kit, which only makes migrations. (#258)