Skip to content

babyrite: v1.4.2

Choose a tag to compare

View all tags
@m1sk9-bot m1sk9-bot released this 31 Jul 08:44
babyrite-v1.4.2
2095612
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

This release contains three security fixes. All three are in the decision of whether a message link may be expanded, and each of them could cause the contents of a channel the reader cannot view to be expanded. If you run babyrite in more than one server, please update promptly.

Advisory Summary Severity Affected
GHSA-vqqw-5pfp-qv9g A forged message link could read a private channel in another server 7.7 High >= 0.11.0, < 1.4.2
GHSA-fgg3-r9gf-q7rj A channel permission change was not reflected for up to 12 hours 6.3 Medium >= 0.11.0, < 1.4.2
GHSA-8q64-5qhq-rr54 A private channel built from per-member overwrites could quote a role-gated channel 6.3 Medium >= 1.3.0, < 1.4.2

Two related problems are fixed as well: threads under an NSFW channel slipped past the NSFW gate, and GitHub file content could escape its code fence and send mentions under the bot's identity.

docker pull ghcr.io/m1sk9/babyrite:v1.4.2

Note

babyrite is not published to a package registry, so Dependabot cannot alert you about any of this. Updating is manual.

Important

This release changes existing behaviour.

  • A private channel whose access comes from per-member overwrites may now only quote channels everyone can view.
  • The channel cache time-to-live is 1 hour instead of 12, and channel permission changes now take effect immediately.
  • Links refused by the visibility policy are logged at debug rather than error.

1.4.2 (2026-07-31)

Bug Fixes

  • cache: invalidate cached channels when their permissions change (#648) (fe25c8c)
  • cache: reject cached channels that belong to another guild (#642) (ceace26)
  • discord: judge NSFW on the parent channel for threads (#646) (fd1b038)
  • discord: refuse restricted targets when the source grants access per member (#651) (35d3e4b)
  • event: stop code blocks from parsing mentions or escaping their fence (#647) (7f8db73)
  • github: enforce the raw fetch size limit on received bytes and stop reading once enough lines arrive (#645) (b445550)

Miscellaneous

  • deps: update dependency wrangler to v4.116.0 (#640) (41569c6)
  • expand: consolidate cross-guild rejection into Preview::get (#644) (02443cd)
Assets 2
Loading