v0.7.11

0.7.11 (2026-11-13)

Bug Fixes

• abort file writes when permissions cannot be set (a230a5e)
• align exact query explanations with resolution order (0cfc1ec)
• align redirect diagnostics with browser and matcher behavior (b4d0bfd)
• avoid full table scans for session activity updates (575f4e5)
• bind rate limit refunds to their original windows (1abaff6)
• correct OAuth discovery paths and enforce collision tests (d514f3c)
• detect redirect loops by repeated request states (b4cba00)
• make rate limit admission safe during concurrent resets (56c5717)
• measure coverage only for current source modules (4e41054)
• preserve active log permissions after rotation (1607573)
• preserve audit permissions during atomic rotation (2c647f0)
• preserve existing paths during configuration probes (64dd6f9)
• preserve file order for tied query rules (509d926)
• preserve permissions during atomic log compression (4dc695e)
• preserve secret contents when trimming CRLF files (22a6214)
• protect existing atomic write temporary paths (b818fbe)
• quarantine hit counts outside native counter bounds (782f2b1)
• rank Unicode prefixes by consumed request path (b5c9342)
• redact URL fragments before query delimiters in access logs (1478aa5)
• refresh recently modified API client cache entries (62f78f8)
• replace upstream dates removed by connection filtering (09fe4e5)
• restore audit archives when rotation publication fails (96a9a50)
• track session activity without stale updates (6ffa6d8)
• verify permissions after raced log reopening (6117e5a)

Dependencies

• bump alpine from 3f4d6b3 to f59abe6 (#182) (78da8da)

Documentation

• bump playwright from 1.64.1 to 1.65.0 in /docs in the docs group (#183) (8e73de5)

v0.7.10

0.7.10 (2026-11-11)

⚠ BREAKING CHANGES

• with trailing_slash = "ignore", a request whose host has a rule for the other trailing slash form now gets that rule instead of a matching *.parent or * rule.

Bug Fixes

• matching precision, store reads that do not wait, and the Erlang helpers by area (#179) (a85ef93)
• oidc: keep the metadata a provider outage falls back on (#180) (09488fc)

v0.7.9

0.7.9 (2026-11-11)

⚠ BREAKING CHANGES

• a proxy that sets the auth.header identity headers for the upstream must be listed in auth.header.trusted_proxies. Users now store credentials: an older version rewriting users.json drops them, which ends every admin session.

Bug Fixes

• findings of a codebase audit (#176) (67443ef)

v0.7.8

0.7.8 (2026-11-10)

⚠ BREAKING CHANGES

• with api.require_if_match, PATCH without If-Match answers 428; imports refuse new ids that are not URL-safe; imports and bulk enabling refuse rules they add, change or enable that loop or can never apply.

Features

• stricter checks on PATCH, imported ids, imports and bulk enabling (#174) (261ea89)

v0.7.7

0.7.7 (2026-11-10)

Bug Fixes

• proxy: listener edge cases after a hot upgrade or an early disconnect (#172) (2c075d9)

v0.7.6

0.7.6 (2026-11-10)

Bug Fixes

• audit fixes for logs, config, API and rule imports (#170) (5ffe2c7)

v0.7.5

0.7.5 (2026-11-10)

Features

• proxy: limit open connections per client address (#168) (d23e189)

v0.7.4

0.7.4 (2026-11-10)

⚠ BREAKING CHANGES

• OIDC sign-in with no allowed_emails, allowed_domains or allowed_groups does not start unless auth.oidc.allow_any_account = true; api.oauth.require_at_jwt defaults to true; without admin.metrics_token, /metrics answers 404 on a listener that is not on the loopback interface (as in the container image).

Bug Fixes

• harden the listener, proxy, admin and API (#165) (7f96487)

Performance

• less work per request on the redirect listener (#166) (ec50e42)

v0.7.3

0.7.3 (2026-11-09)

Bug Fixes

• auth: completed SSO logins do not count against their address's 30 SSO starts (eab5afe)
• matcher: a prefix rule refused by its host guard leaves the request to a shorter prefix rule (eab5afe)
• proxy: linger before closing a connection whose request body was not read (answered, rejected, or answered early by the upstream), so that the client gets the response (eab5afe)
• proxy: repeated Connection headers are one list when answering, as when forwarding (eab5afe)
• store: create the backups directory only when backups are kept, and rotate backup files only (eab5afe)
• store: the redirect loop check follows rules that keep the query they matched (eab5afe)
• tester: the URL tester follows preserved queries, ranks prefixes in bytes and tells requests apart by their query (eab5afe)

Security

• auth: a login re-hashing a password no longer restores the old password over a reset made meanwhile (eab5afe)
• proxy: drop a client's X-Forwarded-Host, -For and -Proto from untrusted peers, also for an HTTP/1.0 request without Host (eab5afe)
• proxy: parse a request head again only when it may be complete, not at every new line, nor at every packet without one (eab5afe)

Documentation

• api: document the 400 of non-object JSON bodies, and the token endpoint's 413 (64 KiB) and 415 (eab5afe)

v0.7.2

0.7.2 (2026-11-08)

Bug Fixes

• admin,cli: report a busy rules store (503 page, exit 1) instead of crashing (#156) (e908fa9)
• csv: quote cells whose quote, comma or line break precedes a combining mark (#155) (7fcb9c4)
• matcher: whole-segment prefixes ending with a slash match the paths below them (#152) (726d030)
• proxy: harden the redirect listener against slow heads, connection floods, h2c and forged identity headers (#148) (ad6bd07)
• store: keep held locks fresh, skip changes whose caller gave up, answer 503 when busy (#149) (42c40e1)

Performance

• parse trusted proxy networks once and compare peer addresses as integers (#159) (112fe6c)
• proxy: cheaper upstream forwarding: no reuse probe, one send per small response, fewer lowercasings (#158) (5bd17d2)

Documentation

• migration from nginx and Apache, Kubernetes and Compose, trust settings, CLI reference (#150) (84c776c)

Behaviour changes to check when upgrading

• h2c is refused: Upgrade: h2c is removed from requests forwarded to the upstream, and a 101 whose protocol differs from the one requested becomes a 502. WebSocket upgrades are unchanged.
• Identity headers from untrusted peers are dropped: X-Client-IP, True-Client-IP and, when header authentication is on, its user, email and role headers, as well as _ spellings of the headers the proxy sets. Trusted proxies still pass them through.
• Request heads have a deadline: the whole head must arrive within the idle timeout (408 otherwise), and connections beyond 90% of the VM's port limit are closed at once.
• A busy rules store answers 503 (store_busy, Retry-After: 1) on the API and admin pages, and rules import exits 1, instead of failing with a 500 or a crash.