Skip to content

v1.8.2

Choose a tag to compare

View all tags
@seakee seakee released this 05 Mar 02:59
· 14 commits to main since this release
v1.8.2
5d923b6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes v1.8.2

Release Date: 2026-03-05
Previous Version: v1.8.1

Overview

This patch release hardens the main branch security baseline across dependencies, middleware behavior, configuration defaults, and container build reproducibility.

What's Changed

  • Upgrade Go baseline to 1.24.13 and refresh transitive dependencies.
  • Harden CORS to allowlist mode via CORS_ALLOW_ORIGINS (deny by default).
  • Reject disallowed CORS preflight requests and add Vary: Origin.
  • Redact sensitive fields in request logging for JSON and form payloads.
  • Disable production debug_mode by default.
  • Pin Docker images to golang:1.24.13-alpine and alpine:3.21.

Notes

  • CORS is now stricter: set CORS_ALLOW_ORIGINS explicitly in deployment environments.

Validation

  • go test ./app/http/middleware
  • go test ./app/... ./bootstrap/...
  • govulncheck ./... (no vulnerabilities found)
Assets 2
Loading