Skip to content

Release v1.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jul 18:23
· 40 commits to main since this release
v1.1.2
b80c921

v1.1.2 — Storage / HMAC / demo hardening

Corrupt JSON fail-closed, flock on mutations, signing key ≥32 chars,
UNSAFE banners when panel.role is null.

Changelog

Security

  • Filesystem storage fails closed on corrupt JSON (no silent wipe on next save).
  • Exclusive flock on {paths}.lock for read-modify-write mutations.
  • Export/import signing key must be ≥32 characters (panel.export_signing_key validated; runtime check also covers kernel.secret).
  • Panel shows an UNSAFE banner when panel.role is null; demo home page warns similarly.

Compatibility

  • PHP >=8.2, <8.6; Symfony ^7.4 || ^8.0 (CI minors 7.4, 8.0, 8.1).
  • BC notes: weak signing keys (<32 chars) now fail export/import; corrupt paths.json throws instead of loading as empty.

Full Changelog: v1.1.1...v1.1.2

Assets 2
Loading