Skip to content

v1.2.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 19:51
Immutable release. Only release title and notes can be modified.
v1.2.5
793f616
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening notes

v1.2.5 is a security hardening patch from the July 2026 Codex Security scan. It tightens several safety boundaries without removing supported workflows:

  • Cross-host HTTP redirects are blocked by default to avoid forwarding custom auth headers to unexpected hosts. Set http.allow_cross_host_redirects: true only when cross-host redirects are intentional.
  • Opt-in cross-host redirects now pass through per-domain rate limiting before the redirected request is sent.
  • sendit generate --url keeps robots.txt sitemap discovery within the seed origin and skips oversized HTML and sitemap responses.
  • The optional Prometheus metrics listener now binds to loopback by default because metric labels include target domains. Set metrics.bind_address: 0.0.0.0 only when exposing metrics intentionally.
  • Scheduled pacing now remains paused outside active cron windows instead of dispatching after each poll interval.

No CVE has been assigned for this release.

Changelog

Bug fixes

  • b0eea9f fix: bind metrics to loopback by default (#244)
  • 07a6b0a fix: block cross-host HTTP redirects by default (#240)
  • 37c6e6b fix: bound generate crawl response parsing (#243)
  • 159dc00 fix: keep robots sitemaps on seed origin (#242)
  • 6bafeff fix: keep scheduled pacing inside cron windows (#245)
  • 2a5ce5f fix: rate limit cross-host HTTP redirects (#241)

CI / build / dependencies

  • f2075a3 build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 (#228)
  • 8294bd7 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#225)
  • ee32488 build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (#227)
  • a2b2f3e build(deps): bump dorny/paths-filter from 4.0.1 to 4.0.2 (#233)
  • cb9b15a build(deps): bump github.com/coder/websocket from 1.8.14 to 1.8.15 (#224)
  • ee54ec0 build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#238)
  • c3dca08 build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#234)
  • fc4bf16 build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#232)
  • 23fa53d build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#236)
  • f95f778 build(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0 (#229)
  • d025853 build(deps): bump the codeql-action group across 1 directory with 4 updates (#239)
Assets 25
Loading