What's Changed
- ci(docs): deploy GitHub Pages from an Actions artifact by @MegaManSec in #139
- ci(release): release when master has a new version instead of on a GitHub Release by @MegaManSec in #140
- chore: add a GitHub Sponsors button by @MegaManSec in #141
- docs: use asterisk emphasis everywhere and enforce it by @MegaManSec in #143
- fix(add_header_content_type): match hide_header to the upstream module by @MegaManSec in #144
- feat(ssl_ecdh_curve): flag lists that turn off post-quantum key exchange by @MegaManSec in #142
- fix(http2_misdirected_request): widen default-server and 421 checks by @MegaManSec in #145
- fix(core): close variable-model and regex-capture gaps by @MegaManSec in #147
- feat(core): parse atomic groups and possessive quantifiers by @MegaManSec in #148
- fix: close four small plugin detection gaps by @MegaManSec in #150
- fix(origins): follow set chains and more_set_headers for CORS reflection by @MegaManSec in #146
- fix: scanner robustness against malformed and hostile input by @MegaManSec in #149
- fix(allow_without_deny): simulate the nginx rule lists and report shadowed rules by @MegaManSec in #151
- fix(add_header_content_type): honour _pass_header Content-Type when resolving the hide list by @MegaManSec in #156
- fix(origins): follow set directives only within the header's server and location scope by @MegaManSec in #153
- fix(core): model client-controlled builtin variables from the nginx source by @MegaManSec in #154
- fix(http2_misdirected_request): ignore regex locations that NGINX never consults by @MegaManSec in #155
- fix(ssrf): treat $host as client input in default and catch-all servers by @MegaManSec in #152
- chore(release): 0.12.0 by @MegaManSec in #157
Full Changelog: v0.11.0...v0.12.0