TecharoHQ/anubis v1.28.2

v1.28.2: Wuk Lamat Echo 2

on GitHub

This is mostly for the eMudhra debacle (CVE-2026-111943).

Features

• Add Catalan (ca) localization.
• Allow Renovate in git clients for github/gitlab api endpoint.

Fixed

• Add utils/cmd/botgenerate for automatically updating crawler IP ranges. Also apply the updates.
• Do not reject with 400 Bad Request a request whose Content-Type is multipart/form-data but whose body is empty, including when the content length is unknown (-1, for example a chunked request). Reverse proxies that strip the body for auth subrequests (for example nginx' auth_request) still forward the original Content-Type, which made prepareChallengeForm fail and answer with a spurious 400.
• Reject requests with no User-Agent header or an empty User-Agent header via (data)/bots/spec-violations.yaml.
• Accept GeoIP2 ISP databases for ASN lookups and GeoLite2 City databases for country lookups.
• Fix concurrent WASM challenge validation failures by instantiating transient modules anonymously, allowing the existing four-slot verifier concurrency limit to work as intended.

New Contributors

• @yaoge123 made their first contribution in #2026
• @codeandsolder made their first contribution in #2021
• @AltintasMehmet made their first contribution in #2019
• @Ereza made their first contribution in #2058

Full Changelog: v1.28.1...v1.28.2