This release adds an optional feature to mitigate DNS rebinding attacks (read more), as well as other hardening fixes.
Security
- Add
--allowed-hostsflag to mitigate DNS rebinding against the API
Chore
- Update Go dependencies
- Update node dependencies
- Update Github Actions
Fix
- Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list
- Pass line-boundary state to drainData to prevent SMTP desync
- Allow SP inside quoted local-parts per RFC 5321 (#731)
- Bound header-rewrite scanner to header block and fail closed on missing header
- Prevent quadratic CPU in proxy CSS rewriter via O(1) asset dedup