Skip to content

v0.17.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 May 16:01
v0.17.0
d3c8e1b

Docker

docker pull ghcr.io/lucaslra/montly:0.17.0

Security

  • Request body size limits — parseTaskBody, CreateWebhook, and CreateUser now cap request bodies before decoding (16 KB / 4 KB respectively), preventing memory exhaustion via oversized payloads
  • bcrypt password length cap — passwords are now rejected above 72 characters at all entry points (setup, create user, change password); bcrypt silently truncates at byte 72, which would allow any input sharing the first 72 bytes to authenticate as the same account
  • SSRF protection for webhooks — webhook delivery resolves hostnames before connecting and rejects any IP in loopback, RFC 1918, link-local (covers cloud metadata endpoints like 169.254.169.254), carrier-grade NAT, and IPv6 unique-local ranges; redirects are re-validated at each hop and capped at 3

Added

  • Migration step logging — startup now logs each schema change as it runs, or confirms "migration: schema up to date" when nothing needs applying
Assets 2
Loading