sgasser/pasteguard v0.9.8

PasteGuard 0.9.8

on GitHub

PasteGuard 0.9.8 patches security advisories in hono and in the PostCSS dependencies used to build the dashboard stylesheet.

Security fixes

• Update hono from 4.12.31 to 4.13.18. #193
  • Advisories in the GitHub Advisory Database: GHSA-8j4g-w8fx-2239, GHSA-f23p-vx2j-j53r, GHSA-79qm-7rj5-m7r9, GHSA-54fx-42gc-7vw4, GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx, GHSA-hxh3-vqpv-xpqv and GHSA-5r4p-p66f-jhc7.
  • hono repository advisories fixed in 4.13.16 and 4.13.18: GHSA-4m76-xfj5-7975, GHSA-h7mg-cq63-vhpq, GHSA-4h7h-rv7c-7m2v, GHSA-3gg2-335m-rxc6, GHSA-46wx-v44x-9hh2, GHSA-92p4-j3wq-jmqx, GHSA-39q9-qp46-w8xg, GHSA-h25j-2p75-qj33 and GHSA-74fm-fwc7-3fwp.
• Update postcss from 8.5.18 to 8.5.32 (GHSA-fxqj-rqcc-2cmp). #193
• Update nanoid from 3.3.12 to 3.3.20 (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8). #193
• Update source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q). #193

bun audit reports no vulnerabilities for this release. The dashboard stylesheet compiles to the same output as before.

Behavior changes

These come from the hono update:

• Request bodies sent with a Content-Type that has whitespace before its parameters, such as application/json ; charset=utf-8, are now parsed as JSON. Previously /codex/responses accepted such a request as {} and forwarded an empty object upstream, so the request was lost. No request content was forwarded unmasked.
• Passthrough requests to provider paths that PasteGuard does not intercept, such as /openai/v1/models, no longer return upstream response headers that the upstream lists in its Connection header.
• CORS responses now list QUERY in Access-Control-Allow-Methods. Provider proxy routes still reject requests from browser origins.

Upgrade note

No configuration changes are needed. Upgrade the all-in-one image to ghcr.io/sgasser/pasteguard:0.9.8 or pull the updated latest image.

Full changelog: v0.9.7...v0.9.8