v1.23.5: Dependency updates, Alpine base image digests & CI hardening

Maintenance & Dependency Updates

• Python Dependencies (#240):
  • Updated pydantic from 2.14.2 to 2.14.3
  • Updated pydantic-core from 2.50.2 to 2.50.4
  • Updated anyio from 4.15.1 to 4.16.0
  • Updated pytest-asyncio from 1.4.1 to 1.4.1.post1
  • Updated ruff from 0.17.3 to 0.17.4
  • Updated typing-inspection from 0.4.4 to 0.4.5
  • Maintained strict parity between uv.lock and cf-tunnel-sync/requirements.txt
• Base Images (#238, #239):
  • Refreshed python:3.11-alpine base image digest in cf-tunnel-sync/Dockerfile (#238)
  • Refreshed nginx:alpine base image digest in cf-tunnel-dashboard/Dockerfile (#239)
• CI / GitHub Actions (#241):
  • Updated github/codeql-action to 4.39.3, docker/login-action to 4.8.0, sigstore/cosign-installer to 4.1.3 pinned commit SHAs

Validation & Reviews

• All test matrices passing across Python 3.11, 3.12, 3.13, and 3.14.
• Container smoke tests and OSV security scans verified green.
• Reviews approved by @MustermenschAlex, @kuenstlichedummheit-sys, and @majorungustl.

v1.23.4: Non-breaking hardening ISS-01..ISS-18 with opt-in warnings and strict modes

Summary

Non-breaking hardening for ISS-01..ISS-18 (opt-in warnings, strict modes, example pins, best-effort hardening, internal refactor). Closes #218 #219 #220 #221 #222 #223 #224 #225 #226 #227 #228 #229 #230 #231 #232 #233 #234 #235.

Backward Compatibility

No env var, label, endpoint, CLI flag, or mount path renamed/removed. Defaults unchanged. New behavior opt-in or warn-only. Downgrade to v1.23.3 remains zero-downtime compatible.

New opt-ins

• DASHBOARD_AUTH_REQUIRED=true (ISS-02)
• PRESERVE_MANUAL_ROOTS=true (ISS-08)
• TOMBSTONE_PERSISTENCE_ENABLED=true (ISS-11)
• SYNC_HEARTBEAT_ENABLED=true (ISS-14)

Verification

375 passed, ruff clean, ruff format clean, mypy success.

v1.23.3: Dependency updates, Alpine base image refresh, and CI actions update

Maintenance & Dependency Updates

• Python Dependencies (#215):
• Updated fastapi from 0.161.1 to 0.162.0
• Updated pydantic from 2.14.1 to 2.14.2
• Updated pydantic-core from 2.50.1 to 2.50.2
• Updated ruff from 0.17.2 to 0.17.3
• Updated opentelemetry-api from 1.45.1 to 1.45.2
• Maintained strict parity between uv.lock and cf-tunnel-sync/requirements.txt
• Base Images (#213, #214):
• Refreshed python:3.11-alpine base image digest in cf-tunnel-sync/Dockerfile (#213)
• Refreshed nginx:alpine base image digest in cf-tunnel-dashboard/Dockerfile (#214)
• CI / GitHub Actions (#216):
• Updated astral-sh/setup-uv to v10.3.3 pinned commit SHA in ci.yml and fuzzing.yml

Validation & Reviews

• All 367 tests passing across Python 3.11, 3.12, 3.13, and 3.14.
• All hermetic gates, OSV security scans, and CodeQL analyses verified green.
• Reviews approved by @MustermenschAlex, @kuenstlichedummheit-sys, and @majorungustl.

v1.23.2: Centralize credential resolution and normalize legacy environment aliases

Configuration & Authentication Refactoring (#210, #211)

• Centralized Credential Normalization:
  • Automated normalization of BASIC_AUTH_USERNAME and BASIC_AUTH_PASSWORD into canonical DASHBOARD_USERNAME and DASHBOARD_PASSWORD in Settings and web authentication resolvers.
• Deprecation Warnings:
  • Emits clear, actionable deprecation warnings when legacy BASIC_AUTH_* configuration variables are detected, alerting operators to transition.
• Zero Breaking Changes:
  • Full backward compatibility guaranteed for existing container deployments and Docker Compose stacks.
• Code Consolidation:
  • Deduplicated basic authentication verification logic into shared _verify_basic_credentials() helper in tunnel_sync.web.auth.
• Documentation & Verification:
  • Updated configuration documentation in docs/configuration.md and cf-tunnel-dashboard/DOCKERHUB.md.
  • Added unit test coverage for alias normalization and deprecation warnings in test_settings.py.
  • All 367 tests and 36 subtests passing cleanly across supported Python versions.
  • Reviews approved by @MustermenschAlex and @kuenstlichedummheit-sys.

v1.23.1: Eliminate unused asynchronous client path and simplify Cloudflare adapter

Cloudflare Adapter Refactoring & Dead Code Elimination (#207, #208)

• Dead Code Elimination:
  • Removed ~105 lines of unreferenced async_request implementation and unused asyncio import in CloudflareClient.
• Pipeline Consolidation & Backward Compatibility:
  • Unified HTTP request execution into a single, cohesive request() method.
  • Maintained complete backward compatibility by preserving sync_request = request alias.
• Verification:
  • Added unit tests validating method parity and backward compatibility in test_cloudflare_resilience.py.
  • All 365 test cases and 36 subtests pass green across supported runtimes.
  • Reviews approved by @MustermenschAlex and @kuenstlichedummheit-sys.

v1.23.0: Harden dashboard Content-Security-Policy and decouple inline assets

Security Hardening & Asset Decoupling (#204, #205)

• Hardened Content-Security-Policy (CSP):
  • Eliminated 'unsafe-inline' and external CDN script origins (https://cdn.tailwindcss.com) from both FastAPI application headers and Nginx reverse proxy configuration.
  • Enforced strict script-src 'self' and object-src 'none' directives for defense-in-depth against cross-site scripting (XSS).
• Decoupled Frontend Assets:
  • Extracted ~500 lines of inline JavaScript from index.html into a standalone, cacheable dashboard.js.
  • Replaced inline event handlers (onclick, oninput, onchange) with decoupled addEventListener registrations.
  • Bundled scoped CSS utility classes directly into dashboard.css, making the dashboard 100% self-contained and air-gap compatible.
• Serving & Multi-Stage Packaging:
  • Added dedicated static asset endpoints (/dashboard.js, /dashboard.css, /static/*) in the backend web application.
  • Packaged static assets into the standalone cf-tunnel-dashboard container.
• Documentation & Verification:
  • Updated API and security documentation in docs/api.md and docs/security.md.
  • Updated DOM sanitization, isolation, and observability regression test suites.

Validation & Reviews

• All 364 tests and 36 subtests passing cleanly.
• CodeQL analysis, OSV security scans, and CI gates passed green.
• Reviews approved by @MustermenschAlex and @kuenstlichedummheit-sys.

v1.22.2: Dependency updates, Alpine base image refresh, and CI actions update

Maintenance & Dependency Updates

• Python Dependencies (#201):
  • Updated fastapi from 0.143.3 to 0.161.1
  • Updated ruff from 0.17.1 to 0.17.2
  • Updated certifi from 2026.10.19 to 2026.10.23
  • Maintained strict parity between uv.lock and cf-tunnel-sync/requirements.txt
• Base Images (#199, #200):
  • Refreshed python:3.11-alpine base image digest in cf-tunnel-sync/Dockerfile
  • Refreshed nginx:alpine base image digest in cf-tunnel-dashboard/Dockerfile
• CI / GitHub Actions (#202):
  • Updated 8 actions (setup-uv, setup-python, codeql-action, login-action, osv-scanner-action) to latest pinned commit SHAs for supply-chain integrity

Validation & Reviews

• All 364 tests passing across Python 3.11, 3.12, 3.13, and 3.14.
• All hermetic gates, OSV security scans, and CodeQL analyses verified green.
• Reviews approved by @MustermenschAlex, @kuenstlichedummheit-sys, and @majorungustl.

v1.22.1: CodeQL security hardening and code scanning remediation

Security & Code Quality Hardening

• CWE-457 Uninitialized Variables Fixed: Refactored container inspection test logic in test_ingress_labels.py to eliminate uninitialized variable paths.
• CWE-20 Webhook URL Sanitization: Upgraded detect_webhook_type() in notifications.py to use urllib.parse.urlsplit for strict hostname validation, mitigating substring matching bypasses.
• CWE-116 HTML Sanitization Refactoring: Replaced regex-based <script> extraction with standard library html.parser.HTMLParser in test helpers (test_dashboard_dom_sanitization.py).
• CodeQL Quality Invariants:
  • Explicit __all__ exports declared across all historical compatibility modules (app.py, reconcile.py, notifications.py, metrics.py, validation.py).
  • Added clarifying comments to all 18 empty except blocks across adapters, application, domain, and web layers.
  • Replaced ellipsis literals in Protocol interface methods with raise NotImplementedError and added docstrings to @overload signatures in settings.py.
  • Refactored assertions in test contracts from generic boolean comparisons to assertEqual and assertGreater.
• OpenSSF Scorecard Hardening:
  • Restricted top-level workflow token permissions to read-all in .github/workflows/osv-scanner.yml.
  • Added repository-root SECURITY.md with structured vulnerability disclosure policies, SLAs, and contact details.

Validation & Reviews

• Full regression suite verified: 364 tests passing across Python 3.11, 3.12, 3.13, and 3.14.
• All 10 CI checks passing green, including CodeQL Analysis.
• Code review approved by @MustermenschAlex in PR #192.

v1.22.0: Filter unlabeled container events & debounce optimization

Features & Performance Improvements

• Unlabeled Container Filtering: Docker container lifecycle events are now checked for Cloudflare tunnel labels (cf.tunnel.*, cloudflared.*, cftunnel.*, tunnel.*, shorthand aliases). Events from unrelated containers (such as databases, cron jobs, or monitoring agents) are ignored, avoiding unnecessary debounced sync loops and Cloudflare API queries.
• Connector & Active Service Preservation: Lifecycle events for the cloudflared connector container and previously active services in memory are always processed, ensuring container restarts and deletions cleanly trigger ingress and DNS reconciliation.
• Removed Premature kill Action: Removed kill from CONTAINER_LIFECYCLE_ACTIONS to avoid premature debounce triggers before container processes have finished their shutdown grace period; process termination (die) and status updates (stop) are used instead.
• Configurable Override: Introduced FILTER_UNLABELED_EVENTS setting (default: true). Set to false if all container events must trigger synchronization.

Validation

• Comprehensive unit tests covering label detection, event suppression, connector handling, and tombstone tracking.
• All 12 CI gates passed (CodeQL, continuous fuzzing, unit & container smoke gates, OSV-Scanner).
• Independent code review and squash merge completed by MustermenschAlex in #190.

v1.21.2: Fix OSV-Scanner reusable workflow ref

Bug Fixes

• CI/Security Scanning: Pin google/osv-scanner-action reusable workflows in .github/workflows/osv-scanner.yml to exact commit SHA b1d267aea5211fa648d9d442fa64b90dbdcbdd36 (v2.7.0), resolving the workflow parse failure caused by upstream's lack of a floating @v2 ref.

Validation

• All 12 CI checks, including osv-scanner, passed on PR #189.
• Independent review and merge completed by MustermenschAlex in #189.