Skip to content

2.29

Choose a tag to compare

View all tags
@hbenali hbenali released this 10 Oct 15:45
· 53 commits to master since this release
2.29
d7447ed
This commit was signed with the committer’s verified signature.
hbenali Houssem Ben Ali
SSH Key Fingerprint: xOCXKkxuU9SZpWrXxETWsXX5MldLDAehWb5cedtWMHk
Verified
Learn about vigilant mode.

Security

  • Fix: with -U/-P set, the log stream's socket.io namespace was not covered by the session check, so a client with no cookie could still connect and receive log lines. It is now enforced (regression test added). Upgrading is recommended for anyone using Basic Auth.
  • Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy).

Features

  • --config <path> JSON config file (CLI flags win), with an optional files list.
  • Graceful shutdown on SIGINT/SIGTERM.

Maintenance

  • Requires Node >= 22.12 (Node 20 dropped); CI runs on 22 and 24.
  • Dependencies bumped to latest majors: commander 15, cookie 2, serve-static 2, jsdom 30, sinon 22, etc.; dropped command-exists, untildify, uuid, configstore, is-docker, universal-analytics.

Included from 2.28

  • --password-file and FRONTAIL_USER/FRONTAIL_PASSWORD keep the password out of ps; constant-time credential comparison; removed dead Google Universal Analytics (--disable-usage-stats is a deprecated no-op).

Full Changelog: 2.28...2.29

Assets 7
Loading