v0.32.1

Security

• Prevent Vega diagrams from bypassing KROKI_SAFE_MODE=SECURE's URL-loading restriction: the guard only inspected spec.data and the direct children of spec.marks, so a URL-bearing data definition nested inside a group mark (marks[].marks[].data[].url) reached Vega's loader unchecked, allowing SSRF and local file reads (e.g. file:///etc/passwd); separately, an image mark's encode.*.url (e.g. encode.enter.url) is fetched directly by the renderer and wasn't inspected at all, allowing SSRF (e.g. against cloud metadata endpoints) even without any data block. Fixed by recursively scanning every mark, however deeply nested, for a url on either data or encode

Diagram libraries

• Update bpmn-js to 18.22.1

What's Changed

• chore(deps): update java dependencies to v1.6.1 by @ggrossetie in #2126
• chore(deps): update build tooling by @ggrossetie in #2124
• chore(deps): update dependency bpmn-js to v18.22.1 by @ggrossetie in #2125
• chore(deps): update docker/dockerfile docker tag to v1.26 by @ggrossetie in #2127
• ci: restrict default GITHUB_TOKEN permissions per workflow by @ggrossetie in #2133
• fix: block Chromium's calls to Google in the companion browser instance by @ggrossetie in #2129
• chore(deps): update node.js to v24.19.0 by @ggrossetie in #2131
• chore(deps): update dependency buildx to v0.36.0 by @ggrossetie in #2130

Full Changelog: v0.32.0...v0.32.1