16 releases 19 tags

RSS feed

• v1.0.3 ce5402fef4

  Compare

  v1.0.3 — Security hardening Stable

  claude-bot released this 2026-07-18 14:28:31 +00:00 | 163 commits to main since this release

  Patch release: security hardening. Closes the security findings from the 2026-07-17 codebase audit. Behaviour-preserving where possible.

  Security

  • Reject placeholder SECRET_KEY (#45) — the example key no longer passes production validation; rejected in every environment; dev uses an ephemeral key with a warning.
  • Stop voip.ms credential leakage (#46) — credentials moved to the POST body, a scrub_secrets() pass redacts all persisted notifier errors, and httpx request logging is quieted. ⚠️ Rotate the voip.ms API password after upgrading.
  • Redact channel config secrets in API responses (#47) — secret-bearing keys are redacted; full config only for users who can manage the channel.
  • Resolve DNS in webhook SSRF validation (#51) — validation resolves and rejects private/loopback/reserved addresses; sends pin the connection to the validated IP (Host/SNI preserved).
  • Vendor frontend assets (#59) — htmx, htmx-SSE, and Leaflet are served locally instead of from the unpkg CDN.
  • Public-surface privacy (#60) — no exact coordinates on the public page; the NWS public route honours public_enabled; disabling sharing revokes the location's NWS tokens immediately.
  • API hardening bundle (#70) — OIDC nonce validation; CSRF-protected POST logout; media cache-key validation + path containment; excluded_event_types persisted on create.

  Full test suite green (417 passed) including new regression tests across all fix areas.

  ⚠️ Operational follow-up

  Rotate the voip.ms API password — it may already be present in historical logs/DB.

  Full changelog: see CHANGELOG.md. PR #93.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads