soft-serve version history

- Fixed LFS import local repository security issue. - Updated CI to use the latest version of golangci-lint. - Merged a commit from a fork.

This release fixes an issue with SSRF protection rules related to DNS resolution. ## Changelog ### Fixed * 879ece7c24bc92b25e1fb0a4da33049ed8b8332a: fix(ssrf): pin resolved IP in dial to prevent DNS rebinding (#791) (@vnykmshr) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.5/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.5/checksums.txt.sigstore.json) files, for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.5/checksums.txt' wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.5/checksums.txt.sigstore.json' ``` Then, verify it using [`cosign`](https://github.com/sigstore/cosign): ```bash cosign verify-blob \ --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --bundle 'checksums.txt.sigstore.json' \ ./checksums.txt ``` If the out

This release includes a bug fix to our SSRF protection rules where it won't do DNS resolutions before checking SSRF. It also adds LFS SSRF security checks so make sure you upgrade your instance to get the latest security updates. ## Changelog ### Fixed * 19bc6279738fa88b2605c3948c835b649ac93c75: fix(ssh): add argument validation to webhook deliveries commands (@aymanbagabas) * 3ef660098ab37a7950457da8ecc25b516e37ce4e: fix(ssrf): handle DNS resolution in SSRF protection (@aymanbagabas) ### Other stuff * e80b18370197c358e6792fab66c816ad27f408ce: Merge commit from fork (@vnykmshr) * 85fecd7a2fe6e17e2c83c6779061a86e4454cc13: ci: sync dependabot config (#774) (@charmcli) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.4/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.4/checksums.txt.sigstore.json) files, for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.4/checksums.txt' wget 'https://github.com/charmbracelet/s

This release patches a critical auth issue that allows any malicious actor to gain access as any user. Please upgrade ASAP! Credits goes to @juancabe, so thank you so much for noticing and reporting this one 🙂 ### Certificate Reloading You can now use SIGHUP signals to hot-reload Soft Serve to update your server's TLS certificates. Thanks to @cheesyhypocrisy for sending working on this feature! ## Changelog ### New! * 28c48548903dcbdf5d73438bce920af34bd66fae: feat: add support for certificate reloading upon SIGHUP (#710) (@cheesyhypocrisy) ### Fixed * 8539f9ad39918b67d612a35785a2b4326efc8741: fix: authentication bypass (@aymanbagabas) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt.sigstore.json) files, for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.3/checksums.txt' wget 'https://github.com/charmbracelet/soft-serve/releases/d

This release patches a security [issue](https://github.com/charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42) related to LFS locks of different users. Thank you @Tomer-PL for reporting and fixing this one 🙂 ## Changelog ### Fixed * 62e2d5cacc058d94cbbebd5936ac7f944578f3c0: fix(ssh): ui: respect anon-access setting for the ui (@aymanbagabas) * 2447a9678e1c9b948ceeb7572cb82e9613d2bcf5: fix(tests): ignore stderr output in SSRF webhook test (@aymanbagabas) ### Other stuff * 000ab5164f0be68cf1ea6b6e7227f11c0e388a42: Merge commit from fork (@Tomer-PL) * ba7d41505323c556a225cb47d53398367b4f32a5: ci: sync golangci-lint config (#767) (@github-actions[bot]) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.2/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.2/checksums.txt.sigstore.json) files, for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.2/checksums.txt' wget 'https://github.com/charmbra

## Changelog ### Security * bb73b9a0eea0d902da4811420535842a4f9aae3b: sec: fix GHSA-vwq2-jx9q-9h9f (@caarlos0) ### Docs * 56e9784b85e816bb80f1a5696b2cc29be336eb9b: docs: Add `IdentitiesOnly` option to ssh command examples (#628) (@robberwick) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.1/checksums.txt), for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.1/checksums.txt' ``` Then, verify it using [`cosign`](https://github.com/sigstore/cosign): ```bash cosign verify-blob \ --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.1/checksums.txt.pem' \ --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.1/checksums.txt.sig' \ ./checksums.txt ``` If the output is `Verified OK`, you can safely use it to verify the checksums of othe

## Changelog ### New! * ea8799b5eb7a67d84a43994f11c18733dd593a66: feat: add CORS headers (#654) (@fetsorn) ### Security * d9639320b8d0ccd76fe6836a042c042b0ebde549: sec: strip ansi from user input GHSA-fv2r-r8mp-pg48 (@caarlos0) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.11.0/checksums.txt), for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.0/checksums.txt' ``` Then, verify it using [`cosign`](https://github.com/sigstore/cosign): ```bash cosign verify-blob \ --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.0/checksums.txt.pem' \ --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.11.0/checksums.txt.sig' \ ./checksums.txt ``` If the output is `Verified OK`, you can safely use it to verify the checksums of other artifacts you d

## Changelog ### New Features * 52f7a9ee5aa9d8921b7948ae1f1e7664781419a4: feat(tui): yank the patch/diff to clipboard (#725) (@ChausseBenjamin) * 6856877cd42acf302776258142009c4ffc0d0fa0: feat: add readiness and liveness probes for self healing (#734) (@Jay-Madden) ### Bug fixes * 397288d590d84378b178889447332e4a3ff66c3e: fix(ui): help menu on file list view (#719) (@eldondev) * 5a2bde5882610b0ba08bf8d9cf339fe2c487e665: fix: check that commit is a SHA1 (#737) (@caarlos0) * fa175c719178ff618c3fb613d5be4928305eb0a1: fix: repo commit help (#736) (@caarlos0) ### Other work * 5d9034c4da24b189f2994b6a718da768d369d114: ci: sync dependabot config (#741) (@charmcli) * 844f17596853bc804093a70444c2138f78e3f0f8: ci: sync golangci-lint config (#732) (@github-actions[bot]) * e5edfd576d2bbd1c885750f94c57704b61894801: sec: update git-module (#742) (@caarlos0) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/v0.10.0/checksums.txt), for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.10.0/checksums.txt' ``` Then, verify it using [`

This is a small release fixing some UI artifacts after upgrading to v2. ## Changelog ### Bug fixes * 8e6fd530129a5f70535c7680bc9036ecd5c3cb8c: fix(ui): use more accurate scroll percent symbol and improve status bar (@aymanbagabas) --- <details> <summary>Verifying the artifacts</summary> First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/0.9.1/checksums.txt), for example, with `wget`: ```bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.9.1/checksums.txt' ``` Then, verify it using [`cosign`](https://github.com/sigstore/cosign): ```bash cosign verify-blob \ --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.9.1/checksums.txt.pem' \ --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.9.1/checksums.txt.sig' \ ./checksums.txt ``` If the output is `Verified OK`, you can safely use it to verify the checksums of other artifacts you do

# Upgraded UI This release upgrades the UI stack to the new v2 stack which includes the latest beta versions of Bubble Tea, Lip Gloss, Bubbles, Glamour, as well as Wish. There are no breaking changes in this release nor any new features. Happy hacking! ## Changelog ### New Features * df3d71c9f66e80da6b9dc99c2660d631afb4fc20: feat(ui): adapt to new glamour v2 updates (@aymanbagabas) * d05c13c9f160f6be26538a3687071a8c2ff8a1a7: feat(web): add support for http git-upload-archive service (@aymanbagabas) ### Bug fixes * e93eeff8f3c56bc25d8dfcaad23604fa7dea9f96: fix(daemon): ensure daemon starts correctly in tests and ignore errors (@aymanbagabas) * d4edeab2c95165950c00debfac6d6807085983cc: fix(daemon): handle multiple listeners gracefully (@aymanbagabas) * 3f646c66d693c88692d0bebd4243349ddb515ed8: fix(daemon): mutex for listeners (@aymanbagabas) * 9b2fe207661b77558d3668ddc776c4e80042a401: fix(server): properly handle server shutdown (@aymanbagabas) * 91f28a8fa20db2435bec18d9084bb4d8fd1ffdd1: fix(server): properly handle server shutdown (@aymanbagabas) * 14a804ad43acc7f18efba1483767ec28039004fa: fix(ssh): honor SOFT_SERVE_NO_COLOR env var in blob command (@aymanbagaba