Version 0.4.12-beta-release

Updates introduced since 0.4.11-beta-release

• 0da08fc Upgrade backend components to catch up with pathes for CVE-2026-78659, CVE-2026-78669, CVE-2026-78663 and CVE-2026-97032 - (Ni Rui) 82AE11AD1E5E8729 E
• 16eb20f Upgrade front-end components - (Ni Rui) 82AE11AD1E5E8729 E

Security

This release includes patches from upstream that fixed a number of DoS vulnerabilities in the HTTP/2 server. Detail: https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs. As usual, please schedule your update to avoid being attacked.

At this point I would advise that if you don't plan to allow public access, maybe consider to host your Sshwifty behind a extra layer of authentication. For example: this is how you can setup HTTP Basic Authentication on a Nginx reverse proxy: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/.

But of course, then you need to follow Nginx's CVE updates too. They got a DoS vulnerability discovered just a month ago.

Welcome to the world of cybersecurity, the patchwork never stops ;)