v0.9.2

Security

Analysis reports no longer publish the application environment. In 0.9.1 and earlier, every report's data.config held Application.get_all_env(:lowendinsight), with only :jobs_per_core_max removed. Any value an application configured under :lowendinsight (an API token, a key, a password, a URL with credentials) was published in every report, and in anything that stored or served reports. data.config now carries only the scoring thresholds.

If you configured anything sensitive under :lowendinsight, treat it as exposed: rotate it, and discard stored reports.

No other changes from 0.9.1.

Installation

{:lowendinsight, "~> v0.9.2"}

Docker Image

docker pull ghcr.io/kitplummer/lowendinsight:v0.9.2

What's Changed

• fix: has_spdx? now looks for actual SPDX document files by @kitplummer in #1
• Test coverage improvements: 67% to 90% by @kitplummer in #2
• chore: bump version to 0.9.1 for hex publish by @kitplummer in #3
• docs: bust coveralls badge cache and update version by @kitplummer in #4
• security: 0.9.2 -- analysis reports publish only scoring thresholds by @kitplummer in #177
• ci(release/0.9): don't move the container latest tag from a maintenance release by @kitplummer in #179

Full Changelog: v0.9.0...v0.9.2