Releases · shudonglin/sub2api

AI API Gateway Platform - 将 AI 订阅配额分发和管理

fix(payment): orders display per-order currency symbol (USD/HKD/EUR/etc.) instead of hardcoded ¥ (#30)
ci: enable CodeQL code scanning for Go and JS/TS, layered on top of gosec + Semgrep (#31)
fix(security): DOMParser-based heading text extraction for TOC, resolves js/incomplete-multi-character-sanitization (#32)
fix(security): cap admin payment dashboard days query at 366 and drop dead compat_turn_state log branch (#33)
chore: dismiss historical OAuth/log/SSRF code-scanning alerts as false positives after triage against existing defenses (logger.With CRLF sanitization, urlvalidator allowlist, sanitizeEmailHeader, resolvePageImagePath containment checks)

📥 Installation

Docker:

# GitHub Container Registry
docker pull ghcr.io/shudonglin/sub2api:2026.05.20

One-line install (Linux):

curl -sSL https://raw.githubusercontent.com/shudonglin/sub2api/main/deploy/install.sh | sudo bash

Manual download:
Download the appropriate archive for your platform from the assets below.

AI API Gateway Platform - 将 AI 订阅配额分发和管理

Automated image pipeline — every merge to main builds and publishes ghcr.io/shudonglin/sub2api:latest, auto-deployed to the production VM by watchtower.
Releases publish versioned tags only and no longer overwrite :latest.
Go toolchain bumped to 1.26.3; Go modules and CI actions updated.
Adapt to x/net 0.54 and testcontainers 0.42 API changes.
Dependency & security updates (mermaid, @stripe/stripe-js, Trivy).
Public-repo guardrails, NOTICE / upstream attribution, docs.

Docker:

# GitHub Container Registry
docker pull ghcr.io/shudonglin/sub2api:2026.05.19

One-line install (Linux):

curl -sSL https://raw.githubusercontent.com/shudonglin/sub2api/main/deploy/install.sh | sudo bash

Manual download:
Download the appropriate archive for your platform from the assets below.