Releases: mkhalid-s/lean-relay
Releases · mkhalid-s/lean-relay
Release list
v0.6.4
[0.6.4] - 2026-07-31
Added
- Continuous CodeQL, secret, dependency, npm, immutable-Action, and OpenSSF
Scorecard security checks, plus scheduled Dependabot updates. - Security ownership, disclosure targets, threat model, test matrix, incident
response, and security-release documentation. - Release SPDX SBOMs and GitHub provenance/SBOM attestations.
- Structured, body-free dashboard authentication failure events.
- Coverage-guided ClusterFuzzLite testing for proxy path, response-header, and
correlation-ID trust boundaries.
Changed
- GitHub Actions are pinned to immutable commit SHAs.
- The ClusterFuzzLite builder image is pinned by digest and covered by weekly
Dependabot updates. - Dashboard responses now set no-referrer, nosniff, and frame-denial headers;
dashboard session cookies useSameSite=Strict. - Proxy paths reject encoded traversal and origin-confusing forms, malformed
upstream response headers are dropped, and health responses no longer expose
the configured upstream target. - Releases are prepared through a protected pull request and finalized only
after exact-SHA CI and security checks pass on the mergedmaincommit.
Fixed
- The tag-triggered release workflow now grants its reusable security gate the
pull-request write permission required by dependency-review's PR summary;
GitHub can now validate the complete reusable-workflow graph on tag pushes. - GitHub Release bodies are now generated deterministically from the matching
version section inCHANGELOG.md.