Skip to content

v1.12.0

Choose a tag to compare

View all tags
@pilinux pilinux released this 15 Mar 15:54
· 116 commits to main since this release
v1.12.0
b89c241
This commit was signed with the committer’s verified signature.
pilinux mahir
GPG key ID: 075F102BF87704CE
Verified
Learn about vigilant mode.

Highlights

This release focuses on security hardening, test coverage expansion, and dependency upgrades. The minimum Go version is now 1.25.0. A directory traversal vulnerability in configuration loading has been fixed, nil pointer dereferences in database initialization have been resolved, and new test codes have been added across the database/, config/, lib/, and lib/renderer/ packages.

Breaking Changes

  • Go 1.25.0 is now required. The go directive in go.mod has been upgraded from 1.24.1 to 1.25.0 (b89c241).

Security

  • Fix directory traversal vulnerability in config loading (4771052). The security() and view() config functions previously accepted unsanitized paths for the 2FA QR directory and template directory. A new ensureConfigDir() / sanitizeConfigDir() pipeline now validates that configured paths remain within the workspace root, preventing directory traversal attacks.

  • Harden lib.ValidatePath() (96be3cd). The path validation function has been rewritten to use filepath.Rel instead of string-prefix matching, which is more robust against edge cases. Empty inputs are now explicitly rejected, and both the full path and allowed directory are cleaned and resolved to absolute paths before comparison.

Bug Fixes

  • Fix nil pointer dereference in database initialization (42e50af). InitDB(), InitRedis(), InitMongo(), and InitTLSMySQL() now check whether config.GetConfig() returns nil before dereferencing it, preventing panics when the configuration has not been initialized.

  • Fix linter error-check warning (0889239). An unchecked error return was corrected to satisfy static analysis requirements.

Refactoring

  • Extract ensureConfigDir and sanitizeConfigDir (96be3cd, 6cd9468). Duplicated directory-creation logic in the security() and view() config functions has been consolidated into two reusable helpers, reducing code duplication and centralizing the validation logic.

  • Introduce package-level indirections for testability (42e50af). sql.Open, mysql.RegisterTLSConfig, filepath.Abs, and filepath.Rel are now accessed through package-level variables, allowing tests to inject failures without requiring real infrastructure.

Test Coverage

This release adds new test codes and significantly improves coverage for previously untested packages.

  • Add comprehensive test suite for SQL database initialization: InitDB() and GetDB() covering MySQL, PostgreSQL, and SQLite drivers (4ff31a8).
  • Add test cases for InitTLSMySQL() including CA loading, client certificate handling, and TLS registration failures (e821985).
  • Add test cases for Redis initialization and connection closure (f926b13).
  • Add test cases for MongoDB initialization and connection closure (af9918b).
  • Add test cases for CloseSQL(), CloseRedis(), CloseMongo(), and CloseAllDB() (3df555a).
  • Add tests for renderer.Render() covering JSON and HTML template rendering paths (d589b8b).
  • Improve test coverage for lib.ValidatePath() with edge cases for traversal patterns, empty inputs, and error injection (4298161).
  • Improve test coverage for lib.ByteToPNG() with platform-specific test files for Unix (c8e5282).
  • Fix platform-specific test build issue where syscall references failed on Windows (e51a5f3).
  • Improve mustGetConfig() test helper function (ffac4fa).
  • Add config tests covering additional missing environment variable cases (466dd0a).
  • Fix test failure caused by missing .env file (d934a34).

CI / Infrastructure

  • Remove Go 1.24.x from CI matrix; CI now targets Go 1.25.0+ (84efc77).
  • Switch to using securego/gosec binary directly instead of go install (2820b34, 1af2183).
  • Limit parallel CI runs to avoid resource contention (334b299).
  • Add coverage reporting from the database/ (internal) package (3e92b15).
  • Ensure newly added files appear in coverage reports (bbba30d).

Dependency Updates

Direct Dependencies

Package Previous Updated
github.com/gin-gonic/gin v1.11.0 v1.12.0 (48c7379)
github.com/getsentry/sentry-go v0.42.0 v0.43.0 (4c1256b)
github.com/getsentry/sentry-go/logrus v0.42.0 v0.43.0 (4c1256b)
github.com/mrz1836/postmark v1.8.4 v1.9.0 (dc756ee)
golang.org/x/crypto v0.48.0 v0.49.0 (918f129)

Indirect Dependencies

Package Previous Updated
golang.org/x/arch v0.24.0 v0.25.0
golang.org/x/net v0.50.0 v0.52.0
golang.org/x/sync v0.19.0 v0.20.0
golang.org/x/sys v0.41.0 v0.42.0
golang.org/x/text v0.34.0 v0.35.0

Documentation

  • Update README.md to list Go 1.25.0+ as the requirement for v1.12.x and recommend v1.12.x for new projects (b89c241).
  • Update SECURITY.md to mark v1.11.0 as end-of-life with final release v1.11.1, and add v1.12.0 as the currently supported version (b89c241).

Full Changelog: v1.11.1...v1.12.0

Assets 2
Loading