dzikoysk/reposilite 3.6.7 on GitHub

Changes

#2789 Fixed LDAP authentication accepting an empty password when the directory allows unauthenticated binds. (Thanks @zachariah-mithani and @Santoshkumarpuppala.) GHSA-r7xm-w54c-7jxh
#2790 Disabled forwarded IP headers by default to prevent clients from bypassing opt-in brute-force protection or triggering login bans for other IPs. (Thanks @zachariah-mithani.) GHSA-57pm-8jxc-fh3g
- Upgrading a direct installation? Clear web.forwardedIp if your shared settings still contain the old X-Forwarded-For default. Keep a forwarded header configured only when every request goes through a proxy that sets the client IP.
#2787 Updated dependencies across all modules. The Docker build also upgrades Ubuntu’s APT packages for CVE-2026-109518.

Sponsors

Thanks to everyone who supported me this month 💛


Active GitHub Sponsors	JobRunr, talismanplatform, rdehuyss, insertt, Kamilkime, joshuasing, Koressi, tipsy, that-apex, P3ridot, oskarscot, Jan Bojarczuk, Rollczi, frankielc, sandrwich

Minimal requirements

Downloads