Skip to content

v1.7.1 Security Hardening Update

Choose a tag to compare

@shuaiplus shuaiplus released this 23 Jun 17:59
· 153 commits to main since this release

Thanks to GN998 for responsibly reporting security issues addressed in this release.

Improved

  1. Stronger security defaults. NodeWarden now applies more conservative handling around sensitive authentication, backup, and file-delivery flows while keeping existing clients compatible. Upgrade is recommended for all deployments. Commits: 7279668, 850fe0f, a2a8f1c, 23b23f3.

Fixed

  1. High-priority security fixes. This release closes multiple reported security issues across sensitive server-side flows. Commits: 7279668, 850fe0f, a2a8f1c, 23b23f3.

  2. Security dependency overrides. Package overrides were added for selected transitive dependencies so installs resolve to patched versions where applicable. Commit: 0daad46.


感谢 GN998 发现并提交了本次发布中修复的安全问题。

改进

  1. 更稳妥的安全默认行为。 NodeWarden 对敏感认证、备份和文件响应流程采用了更保守的处理方式,同时保持现有客户端兼容。建议所有部署尽快升级。提交:7279668850fe0fa2a8f1c23b23f3

修复

  1. 高优先级安全修复。 本次发布修复了多项已报告的安全问题,覆盖敏感服务端流程和响应加固。提交:7279668850fe0fa2a8f1c23b23f3

  2. 安全依赖覆盖。 为部分传递依赖添加了版本覆盖,让安装时尽可能解析到已修复版本。提交:0daad46