sipcapture/homer 11.0.313

on GitHub

What's Changed

• fix(security): harden node /query auth and block sqlite_scan by @adubovikov in #927

Security

• GHSA-rm5w-rqr7-2h54: Node HTTP POST /query (port+1) now always runs ValidateRawSQL; Bearer auth when flight_server.auth_token is set; auto-token on non-loopback binds (.homer_node_auth_token). Coordinator sends nodes[].token.
• GHSA-4687-q698-mccv: Block sqlite_scan and other DuckDB external scanners in ValidateRawSQL.

See SECURITY.md.

Full Changelog: 11.0.312...11.0.313