Skip to content

v1.13.1

Choose a tag to compare

View all tags
@pilinux pilinux released this 30 Jun 10:56
· 18 commits to main since this release
v1.13.1
8de51c8
This commit was signed with the committer’s verified signature.
pilinux mahir
GPG key ID: 075F102BF87704CE
Verified
Learn about vigilant mode.

What's Changed

  • fix: handle case-insensitive env values (8de51c8)
  • fix(config): load JWT priv/pub key independently (ed33828)
  • chore(deps): bump gorm.io/gorm from 1.31.1 to 1.31.2 by @dependabot[bot] in #404

Full Changelog: v1.13.0...v1.13.1

Highlights

⚡ asymmetric JWT keys can now be loaded independently

For ECDSA/EdDSA/RSA algorithms, PRIV_KEY_FILE_PATH and PUB_KEY_FILE_PATH are no longer both required.
Whichever key is provided is loaded; only when both are missing does configuration fail.
This enables signer-only (private key) and verifier-only (public key) deployments.

⚡ environment variables are now matched case-insensitively

Keyword/enum values that are compared against fixed literals downstream are normalized so casing no longer matters:

  • JWT_ALG: eddsa, Es256, HS256 all resolve to the canonical name the JWT library expects
  • DBSSLMODE: disable / require / verify-ca / verify-full
  • LISTTYPE: whitelist / blacklist
  • MONGO_MONITOR_POOL: yes / no
  • EMAIL_TRACK_OPENS: yes / no
  • DBCONNMAXLIFETIME: duration units (1H, 2H30M, 30S now accepted)
  • IP: firewall list

⚡ firewall IP matching hardened

Exact (non-CIDR) IP entries are normalized via net.ParseIP so IPv6 addresses match the client
regardless of case (2001:DB8::1) or form (2001:db8:0:0:0:0:0:1); invalid entries are skipped
instead of being stored as dead keys.

Contributors

dependabot
Assets 2
Loading