Skip to content

Release v2.0.37

Choose a tag to compare

View all tags
@shipdocs shipdocs released this 29 Sep 07:21
· 6 commits to master since this release
v2.0.37
5b9d832

Fixes the in-app updater and clears the open dependency alerts.

Fixed

  • In-app updater: installing the package kills the running GUI (preinst SIGKILLs bastion-gui), which took the updater down with it and left no GUI afterwards. The install now runs in a detached helper that removes the download and starts the new GUI when apt finishes, and reports a failed install with a desktop notification. Update errors are now shown reliably (they were queued on a thread without an event loop and never displayed).

Changed

  • release_tool.sh now uses only the released version's changelog section for the GitHub release notes (it used to include the previous version's notes too).

Security

  • Removed the unused Python packages (Pillow, Scapy, psutil, pystray, tabulate, NetfilterQueue; none is imported by the code) from requirements.txt, and stopped installing them from the packages: the deb no longer depends on python3-psutil, python3-pystray and python3-pil, and the rpm no longer requires python3-pillow/python3-psutil or pip3 installs them in %post. The declared minimums had known vulnerabilities (Pillow 10.2.0 has 29 advisories, fixed in 12.3.0; Scapy 2.5.0 has GHSA-cq46-m9x9-j8w2, fixed in 2.7.0). requirements.txt now lists only PyQt6, the GUI's one real dependency.
  • hickory-proto 0.24 -> 0.26.3 (GHSA: CPU exhaustion from O(n²) name compression when encoding DNS messages; affects 0.3.1 to 0.26.0, patched in 0.26.1). The daemon only decodes DNS responses, so the vulnerable path was not reachable, but the dependency is now current. Adapted dns_snooper.rs to the new API and added tests that parse a real response.
  • bastion-rs/Cargo.lock is now committed (it was git-ignored). It gives reproducible builds and lets Dependabot see the installed versions, which it needs to raise and close alerts.
Assets 4
Loading