vavallee/bindery v0.20.1

v0.20.1 — Security patch

on GitHub

Security patch release addressing findings from the internal audit.

Security fixes

Backend

• B-H1: Prowlarr indexer Create/Update now validate the URL with httpsec.ValidateOutboundURL(PolicyLAN) — prevents SSRF via attacker-controlled indexer URLs
• B-H2: sanitizePath in the file renamer strips ./../empty path components; DestPath and AudiobookDestDir assert the final path stays within the configured base directory
• B-H3: Backup restore and delete handlers validate filenames against ^bindery_\d{8}_\d{6}\.db$ instead of loose substring checks
• B-L1: Image proxy HTTP client re-validates redirect target URLs with PolicyStrict and caps redirect chains at 5 hops

Auth / API

• F-H1: All state-changing /api/v1 requests now require the X-Requested-With: bindery-ui header; the server rejects requests missing it with 403 — defeats classical cross-site request forgery
• F-H2: Hardcover API token moved from ?token= URL query parameter to Authorization: Bearer header — prevents token leakage in proxy logs and browser history
• B-M3: OPDS Basic-auth endpoint now goes through the login rate limiter (was unbounded before)

CI

• I-M1: All actions/checkout steps set persist-credentials: false
• I-M2: govulncheck pinned to v1.1.4 instead of @latest

Upgrading

Drop-in upgrade from v0.20.0. No database migrations, no config changes required.

If you use the Hardcover import list feature, your client integrations that call /api/v1/importlist/hardcover/lists will need to pass the token as Authorization: Bearer <token> instead of ?token=<token>.