txeh-v1.8.1

txeh v1.8.1

A maintenance release. The notable change is hardening how comments and hostnames are written to the hosts file.

Bug fixes

• Strip line-break characters from hostnames and comments (#90). Comments and hostnames passed to AddHost / AddHostWithComment were trimmed but kept embedded \r, \n, \v, \f, and NUL characters. Since the line formatter interpolated those fields directly, an embedded \r\n could split one logical entry across multiple physical lines and corrupt the file when read back (CWE-117). These characters are now stripped both at the input boundary and at render time. Tabs, spaces, and # are preserved, so normal comments are unaffected, and the public API is unchanged.

  This addresses a reported "CRLF injection." For the record: exploiting it through the CLI requires root plus an attacker-controlled -w path, which already grants arbitrary file write without any comment trick, so the privilege-escalation framing does not hold. The real gap was data hygiene for library callers that may pass untrusted input, which is what this fixes.

Documentation

• Adopt the txn2 design system for the docs site (#77).

Maintenance

Routine CI and dependency bumps (codeql-action, gosec, goreleaser, cosign, sbom-action, golangci-lint, setup-go, codecov, rapid). See the full commit list below.

Full changelog

Others

• e6835b8 chore(ci): bump CI dependencies (#71)
• 4a44bdb chore(ci): bump actions/setup-go from 6.2.0 to 6.3.0 (#54)
• 5b2294e chore(ci): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 (#73)
• 22bc0a5 chore(ci): bump anchore/sbom-action from 0.22.2 to 0.23.0 (#57)
• 96f971c chore(ci): bump anchore/sbom-action from 0.23.0 to 0.23.1 (#60)
• fd47a7e chore(ci): bump anchore/sbom-action from 0.23.1 to 0.24.0 (#65)
• 5fedd09 chore(ci): bump codecov/codecov-action from 5.5.2 to 5.5.3 (#62)
• 6ee1551 chore(ci): bump codecov/codecov-action from 6.0.0 to 6.0.1 (#86)
• 44af623 chore(ci): bump github/codeql-action from 3.32.1 to 4.32.2 (#49)
• a74204e chore(ci): bump github/codeql-action from 4.32.2 to 4.32.3 (#50)
• 35fb190 chore(ci): bump github/codeql-action from 4.32.3 to 4.32.4 (#52)
• dad96ee chore(ci): bump github/codeql-action from 4.32.4 to 4.32.5 (#55)
• e66cb5e chore(ci): bump github/codeql-action from 4.32.5 to 4.32.6 (#59)
• cdb139f chore(ci): bump github/codeql-action from 4.32.6 to 4.33.0 (#61)
• d94b163 chore(ci): bump github/codeql-action from 4.33.0 to 4.34.1 (#63)
• 49645c9 chore(ci): bump github/codeql-action from 4.35.1 to 4.35.2 (#74)
• 6d0d8ed chore(ci): bump github/codeql-action from 4.35.2 to 4.35.3 (#81)
• c15ac92 chore(ci): bump github/codeql-action from 4.35.3 to 4.35.4 (#82)
• e4fb26d chore(ci): bump github/codeql-action from 4.35.4 to 4.35.5 (#84)
• 879894b chore(ci): bump github/codeql-action from 4.35.5 to 4.36.0 (#88)
• d324339 chore(ci): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#89)
• da578ac chore(ci): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#53)
• 872853a chore(ci): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 (#75)
• e78b0d0 chore(ci): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#79)
• 1c52bc7 chore(ci): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#85)
• 64d5ade chore(ci): bump securego/gosec from 2.22.11 to 2.23.0 (#51)
• d5fbd59 chore(ci): bump securego/gosec from 2.23.0 to 2.24.7 (#56)
• 9bff86e chore(ci): bump securego/gosec from 2.24.7 to 2.25.0 (#64)
• df4a40a chore(ci): bump securego/gosec from 2.25.0 to 2.26.1 (#78)
• 2c37172 chore(ci): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 (#58)
• afdc323 chore(ci): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 (#72)
• bbac621 chore(ci): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#83)
• d244aa0 chore(deps): bump pgregory.net/rapid from 1.2.0 to 1.3.0 (#80)