HemmeligOrg/Hemmelig.app v7.5.0

on GitHub

Upgrade notes

This release brings the v2 interface and a large set of security fixes. Read these notes before you upgrade.

• Reverse proxy: When the instance runs behind a reverse proxy, set HEMMELIG_TRUSTED_PROXIES to the address or CIDR range of the proxy. Hemmelig now trusts forwarded client IP headers only from these addresses. Without it, IP restrictions and rate limits see the proxy address for every client.

  HEMMELIG_TRUSTED_PROXIES=127.0.0.1

• CLI and API clients: The server no longer accepts plaintext passwords for password-protected secrets. Clients send a password verifier instead. Update the Go CLI to cli-v1.1.0 and the npm CLI to hemmelig@7.1.0.
• Delete through the API: DELETE /api/secrets/:id now requires the x-hemmelig-delete-token header. A successful reveal returns this token.
• File downloads through the API: GET /api/files/:id now requires the x-hemmelig-file-token header. A successful reveal returns one token for each file.
• Docker Compose: BETTER_AUTH_SECRET is now required. Compose stops when it is not set.

  BETTER_AUTH_SECRET=$(openssl rand -base64 32) docker compose up -d

• Analytics: Set HEMMELIG_ANALYTICS_HMAC_SECRET to keep visitor IDs stable across restarts.

Known issue

The creator cannot delete a secret before someone reveals it. The "Burn now" button after creation and the "Delete" action in the dashboard secret list show an error. The recipient can still delete the secret after the reveal. v7.6.0 fixes this.

What's Changed

• chore(cli): set the CLI versions for the next release by @bjarneo (a770007)
• fix(security): block embedded-IPv4 ranges and consume views atomically by @bjarneo (72ac99d)
• docs(docker): add the Easypanel deployment option (#581) by @Ahson-Shaikh (53669ae)
• test(e2e): turn off rate limiting for the test instance by @bjarneo (2e717b6)
• feat(ui): implement the v2 design by @bjarneo (59fc619)
• fix(deps): patch vulnerable transitive packages by @bjarneo (b634671)
• fix(cli): report the package version and refresh security docs by @bjarneo (5263409)
• fix(security): require a reveal token to delete a secret by @bjarneo (e9b46be)
• test(e2e): exercise password protection and weak-password upgrade by @bjarneo (51f80eb)
• fix(security): cap request bodies without cloning the request by @bjarneo (e015783)
• chore: resolve lint and type warnings from the security fixes by @bjarneo (7a9c0bb)
• fix(deploy): require an explicit auth secret in docker-compose by @bjarneo (9481313)
• fix(security): remove the default analytics HMAC secret by @bjarneo (37ea507)
• fix(privacy): encrypt file names by @bjarneo (b2eaee5)
• fix(security): keep secret request tokens out of logs by @bjarneo (983695e)
• fix(security): apply security headers to frontend documents by @bjarneo (35740d8)
• fix(auth): deny API keys for banned users by @bjarneo (d70f620)
• fix(auth): enforce the password policy on auth endpoints by @bjarneo (1228cb6)
• fix(auth): reset email verification when the address changes by @bjarneo (fb9c9f8)
• fix(security): authorize file downloads and attachments by @bjarneo (c19e106)
• fix(security): reject expired secrets on access by @bjarneo (2a86a19)
• fix(security): apply rate limits in managed mode by @bjarneo (49437c4)
• fix(security): bound request bodies and stored metadata by @bjarneo (e5c546b)
• fix(setup): make initial setup atomic by @bjarneo (7221ff2)
• fix(security): pin webhook DNS to validated addresses by @bjarneo (fa7b5c3)
• fix(security): trust forwarded client IP headers only from proxies by @bjarneo (3958d92)
• fix(auth): enforce registration policy on the server by @bjarneo (462aa2e)
• fix(security): keep decryption keys and passwords client-side by @bjarneo (f693fff)
• fix(users): clear add-user form after submission (#571) by @bjarneo (bfa1936)
• feat(i18n): add Portuguese translations (#570) by @bjarneo (dbd1d32)
• fix(cli): update Go crypto dependency (#569) by @bjarneo (a8512f2)
• fix(deps): refresh tooling security patches (#568) by @bjarneo (08819f3)
• fix(deps): align Prisma packages at 7.10.0 (#565) by @bjarneo (b44f454)
• fix(deps): update Hono packages (#563) by @bjarneo (0edb52f)
• fix(auth): upgrade Better Auth to 1.6.30 (#562) by @bjarneo (c7c29e6)
• Bump react-router and react-router-dom (#556) by @dependabot[bot] (e323d7c)
• Bump js-yaml from 4.1.1 to 4.3.2 (#557) by @dependabot[bot] (3c39a61)
• Bump nanoid (#554) by @dependabot[bot] (6534533)
• fix: avoid analytics error banner when tracking is disabled (#549) by @pepepeboom (7c26950)
• fix: remove duplicate TipTap Link extension (#550) by @pepepeboom (b1a1d7b)
• [codex] make request timeout configurable (#552) by @pepepeboom (43f440b)
• fix(api): allow bearer API keys for secret creation (#514) by Jeffrey Boadi (003619e)
• Bump defu from 6.1.4 to 6.1.6 (#522) by @dependabot[bot] (95b69cb)
• Bump kysely from 0.28.14 to 0.28.17 (#534) by @dependabot[bot] (15d1326)
• Add maintainer request to README by @bjarneo (08511da)
• Target the entire route by @bjarneo (06400f7)
• Remove csp from swagger by @bjarneo (1f40cd1)

Full Changelog: v7.4.8...v7.5.0