What's New in v3.5.0
fix: move DAT match path resolution out of async context and add symlink security tests by @pacnpal in #39
Details
app/routes/dat.py: os.path.realpath and is_within_configured_volumes calls wrapped in run_in_threadpool to avoid blocking the event loop; batch endpoint now resolves all paths in a single thread-pool call
tests/test_dat_routes.py: Four new security tests for symlink traversal and symlink loop handling (both return 403, not 500)
v3.4.0 Notes
actions: bump docker/build-push-action from 6.18.0 to 7.0.0 by @dependabot in #31
actions: bump docker/metadata-action from 5.10.0 to 6.0.0 by @dependabot in #32
actions: bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot in #33
actions: bump peter-evans/dockerhub-description from 4.0.2 to 5.0.0 by @dependabot in #34
actions: bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot in #35
npm: bump @eslint/js from 9.39.2 to 10.0.1 by @dependabot in #36
DAT integration: fix 16 bugs across matching, caching, streaming, security, and UI by @pacnpal in #30
Full Changelog: v3.5.0...v3.5.1