Release v0.7.0
2 files changed
+17 −1
M
CHANGELOG.md
+16 −0
M
VERSION
+1 −1
CHANGELOG.md
@@ -1,5 +1,21 @@
# Changelog
+## 0.7.0
+
+Pre-production security hardening, from a full defensive audit (`docs/security/AUDIT.md`, fix plan in `docs/security/FIX_PLAN.md`). Nothing critical was found — this closes the gaps expected before putting real accounts on the instance:
+
+- Login rate limiting (per account and per IP) on the web login, with generic error messages either way.
+- Anti-SSRF on federation discovery: hostname-only validation, private/loopback/link-local/CGNAT IP blocking enforced at dial time (closes DNS-rebinding), 1 MiB response cap.
+- Strict `Content-Security-Policy` and the standard hardening headers (`X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, HSTS); same-origin check on all state-changing POSTs as CSRF defense-in-depth.
+- Certificate revocation: deleting a user or removing an SSH key now immediately blocks any certificate still outstanding for it, instead of waiting out its TTL. Default certificate lifetime cut from 48h to 24h.
+- `gitfed-renew-cert` now requires `-host-key` (or explicit `-insecure`) instead of silently skipping host-key verification.
+- Constant-time password check (no more timing difference between "wrong password" and "no such user").
+- Web sessions: 30-day TTL cut to 7 days, plus an hourly sweep of expired sessions.
+- bcrypt cost 10 → 12.
+- Self-service repo creation is now namespaced to the creator and capped at 100 repos/user.
+- HTTP servers (web + well-known) now have read/write/idle timeouts.
+- Kubernetes: read-only root filesystem, all capabilities dropped, `seccompProfile: RuntimeDefault`, and an egress `NetworkPolicy` scoping outbound traffic away from private ranges.
+
## 0.6.0
- Multi-language UI: French and English, with a switcher in the nav (persisted in a cookie, otherwise detected from the browser's `Accept-Language`). Every existing page was translated, not just new ones.
VERSION
@@ -1 +1 @@
-0.6.0
+0.7.0