Skip to content

2.36

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 17:05
· 6 commits to master since this release
Immutable release. Only release title and notes can be modified.
2.36
This tag was signed with the committer’s verified signature.
hbenali Houssem Ben Ali
SSH Key Fingerprint: xOCXKkxuU9SZpWrXxETWsXX5MldLDAehWb5cedtWMHk
Verified
Learn about vigilant mode.
6651f75
This commit was signed with the committer’s verified signature.
hbenali Houssem Ben Ali
SSH Key Fingerprint: xOCXKkxuU9SZpWrXxETWsXX5MldLDAehWb5cedtWMHk
Verified
Learn about vigilant mode.

Maintenance release: internal restructuring, no behaviour change to speak of

This release reorganises the server code and hardens the project's supply chain. Upgrading is safe and recommended, especially if you are still on a release before 2.35 (which fixed an authentication bypass on the log socket).

Code structure

  • index.js (360 lines) is now a ~40-line entry point. The server is built by lib/frontail.js (start() returns a handle with close()), the per-browser socket logic lives in lib/log_socket.js, and the download endpoints in lib/downloads.js.
  • Tests can now start the server in-process; 209 tests (up from 174), including new tests for the download endpoints, presets and the server lifecycle.

Fixes

  • Container downloads now stop their docker logs process when the browser aborts the download (journal and ssh downloads already did).

Supply chain and security tooling

  • Every third-party GitHub Action is pinned to a commit SHA and enforced by the repository; workflow tokens are read-only by default; the Docker base image is pinned by digest.
  • Explicit CodeQL configuration (JavaScript and the Actions workflows, extended security queries), Trivy scanning of dependencies, config and the Docker image, and an OpenSSF Scorecard run.
  • SECURITY.md with private vulnerability reporting, issue and pull-request templates, CONTRIBUTING.md, CODE_OF_CONDUCT.md and CODEOWNERS.
  • Release tags are signed, and releases are now immutable once published (this one is the first created through the draft-then-publish flow).

Documentation

Assets 8
Loading