razvandimescu/numa v0.22.0

on GitHub

Highlights

🔐 Dashboard & API authentication

The dashboard and REST API now require a token for any non-loopback client — HTTP Bearer or Basic (native browser prompt). No config needed: a token is minted on first start, logged once, and persisted with 0600 perms, so no deployment is ever unauthenticated. Set your own via [server] api_token or NUMA_API_TOKEN; /health stays open for probes. The .numa reverse proxy forwards the real client IP, so proxied dashboard access gets the same check. (#315)

Upgrading with a dashboard already exposed beyond localhost? Your next visit will ask for credentials — the token is in the startup log (printed once) and in api_token inside your data directory (e.g. /var/lib/numa/, /usr/local/var/numa/). Use it as the password with any username, or set your own in numa.toml.

🔏 DNSSEC: record types that were never actually verified

With [dnssec] enabled = true, answers for types Numa stores as raw rdata — TXT, HTTPS, SVCB, SRV, NAPTR, LOC — were reported Secure without any signature verification: their rrsets never matched their RRSIGs, so validation silently skipped them. They are now signature-checked like everything else, including RFC 4034 canonical-form downcasing for SRV/NAPTR targets. DNSSEC validation is opt-in, so only [dnssec] users were affected. (#325, closes #324)

🔗 CNAME chase correctness

Multi-link CNAME chains included in a single upstream response are now followed to the end before sub-querying, chased answers no longer duplicate chain links, and the chase terminates cleanly on record types without native parsing. (#323)

Also notable

• The wire parser is now continuously fuzzed in CI (4 targets, seed corpus), and the repo gained a SECURITY.md disclosure policy (#319)
• Parser hardening: DNSKEY/DS records with rdlength shorter than their fixed fields are rejected (found by the fuzzer, #301); OPT records whose owner name is a compression pointer are recognized (#319)
• Per-client filter_aaaa override in [[client_policy]] (#307, closes #286)
• Query-log entries carry a monotonic seq, so external scrapers (numa-metrics) can page reliably (#310)
• Forward mode re-resolves an undetectable system DNS to DoH on network rescan (#321, closes #169)
• Dashboard query log fills its column height (#302); AUR publishes are serialized (#298)
• Dependency security bumps: quinn-proto (RUSTSEC-2026-0185), crossbeam-epoch (RUSTSEC-2026-0204)