Skip to content

Hashavatar API 0.8.0

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 17 May 11:44
Immutable release. Only release title and notes can be modified.
v0.8.0
f1ac673
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

hashavatar-api v0.8.0

This release updates the public API service to hashavatar 0.8.0.

Changed

  • Updated the API and demo site to hashavatar 0.8.0.
  • Added support for the latest avatar rendering output from the crate.
  • Added GitHub Container Registry publishing for the Wolfi-based container image on release tags.
  • Hardened rate limiting by removing direct lru 0.18.0 usage and using bounded in-repo bucket eviction.
  • Tightened web security headers with CSP nonces and removed unsafe-inline.
  • Hardened JSON-LD rendering against script breakout.
  • Improved HTML attribute escaping.
  • Increased ETag uniqueness by using the full SHA-256 digest.

Testing

  • Extended security invariant checks and regression tests for the new hardening work.
  • Verified with formatting, clippy, tests, cargo-deny, cargo-audit, and local container smoke testing.
Assets 3
Loading
0 Join discussion