Skip to content

v0.18.1

Choose a tag to compare

View all tags
@olegiv olegiv released this 13 Apr 23:06
· 243 commits to master since this release
v0.18.1
d6baf2b

Security Hardening Release

Comprehensive security audit and hardening pass with 60+ security fixes across all layers — no new features, no breaking changes.

Highlights

  • Embed proxy: tokens minted at render time with static secret enforcement
  • XSS prevention: escape Alpine.js x-data values, version previews, media folder names, custom CSS, Sentinel ban URLs
  • API authorization: enforce pages:read for draft access, taxonomy permission for tag auto-creation
  • Sitemap: key cache by configured site_url to prevent host header poisoning
  • hCaptcha: remove insecure default test keys, scrub persisted test keys on upgrade
  • Demo mode: prevent IP leak, rotate admin password on startup, disallow production seeding
  • Deploy scripts: validate inputs, restrict symlink targets, reject leading hyphens
  • DoS prevention: image dimension guards, rate limiter cache bounds, Argon2 hash throttling, webhook debouncer bounds
  • Data protection: CSV formula injection mitigation, symlink traversal prevention, crypto/rand for passwords

Changed

  • Remove {{if}} guards on module template functions (always render)
  • Update golang.org/x and modernc.org dependencies

Fixed

  • Fix embed proxy token origin mismatch
  • Clear scheduled_at on manual publish/unpublish
  • Invalidate page cache on publish toggle
  • Preserve page categories on form validation errors
  • Filter unlisted posts from tag/category pages and search results
  • Fix hCaptcha login lockout when module hooks inactive
  • Harden PageByID language code validation
  • Fix deploy symlink validation portability (Bash 3 compat)

See CHANGELOG.md for full details.

Assets 2
Loading