0 Releases 48 Tags

RSS Feed

• v0.2.0 f3e8a984b0

  Compare

  v0.2.0: stricter token-cookie and credentialed-CORS checks at boot, queued site-cache purge, protected uploads refused into public_url buckets, Upgrading to 0.2 docs (Phase 19.3)

  jakub released this 2026-10-15 21:29:02 +00:00 | 886 commits to master since this release

  Upgrading to 0.2

  Two configurations that started on v0.1.27 now stop the start-up:

  • Token cookie not Secure in production (WR-05): bouncer.LoadCookieConfig
    refuses a cookie whose Secure resolves to false, including an unset
    auth.cookie.secure inferred false from an http or empty app.url.
    Fix: set app.url to the https URL, or auth.cookie.secure explicitly.
  • Credentialed CORS with loose origins (WR-04): with
    supports_credentials: true, under http.cors or any
    http.cors_profiles., a wildcard origin other than a whole
    leftmost host label, an allowed_origins_patterns entry not anchored
    with ^ and $, and any rule that matches outside the configured
    domains fail the start-up, naming the key and index.
    Fix: list exact origins, or use anchored patterns.

  Behaviour changes:

  • Site-cache purges after an admin save are queued after commit and
    coalesced, one request in flight per purger (WR-01); tests call
    cooler.SiteCachePurger.Wait, serve drains the queue on shutdown.
  • While storage.uploads.public_url is set, attach.Store refuses
    protected uploads with attach.ErrProtectedNeedsPrivateBucket (WR-07).
  • golem15.journal.site_cache.purge_url / purge_token are deprecated
    aliases of site_cache.purge_url / purge_token; the framework keys win.
  • Smaller hardening: zero bouncer.CookieConfig writes SameSite=Lax and
    Secure; /api-docs runs only nonce-carrying scripts; a boot warning for
    turnstile routes without a secret; cors: headers on every
    response of the route, refusals and recovered panics included.

  From here the minor version goes up when an upgrade can refuse a
  previously valid config or changes a documented behaviour; patch
  versions are safe to take without reading.

  Details: docs/setup/upgrading.md

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)