Skip to content

degoog

v0.16.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo Privacy & Ad-blocking
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

aggregator degoogle degoogle-your-life degoogling search-engine self-hosted

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Fix UI session sync bug and add API key protection for search endpoints.

Full changelog


Join our discord community


Changelog

bugfixes

  • Fix bug where session expired but UI hadn't caught up, not a real security issue, however it was very annoying for users.
  • Fix bug where extension description were not scrollable.
  • Add ability to use proxy auth with fetch. NOTE: If your proxy URL omitted the port and your proxy ran on
    8080, add :8080 explicitly as proxies default on port 80 by default now (as it should be) #106
  • Tabs showing when all engines were disabled
  • Tabs not working when searching with a bang for one engine (they should just not show instead) #109
  • Allow post search to accept keypairs payloads #108

features

  • Change the way the internal image proxy works, server side signs images via HMAC instead of having a list of hardcoded allowed origins, it's smarter and allows for more customisation. That means eventually store engines will deprecate the allowedOrigin array, and they'll only work with degoog 1.15.1 onward.
  • Added the ability to protect search and search suggestion endpoints with an api key, this should help a bit with bot control in case, the UI uses the same HMAC system I implemented for proxies, given it was already there may as well make use of it for everything that needs to stay protected. You can check the api section of the documentation to see how to use your api key
  • Added a search bar on the left sidebar of the setting page, this will help you navigate in the now MANY settings available. Made this mostly for myself as these settings are getting out of hand lol
  • Made a big upgrade to the built in at a glance plugin, it won't always fetch the first result anymore, it's a bit smarter than that, also it'll purposely avoid wikipedia results if you have the wikipedia plugin enabled, so there are no redundancies. Make sure to check the plugin configurations as you can set a few things (e.g. stop it from actually fetching and scraping the search result).
  • Add ability to use a DEGOOG_BASE_URL env variable if you need to host degoog on specific paths (e.g. example.com/degoog). Bear in mind, this may not work with specific plugins until developers catch up to the change. Leaving it empty will just default to current behaviour so I won't consider it a breaking change.

potential breaking changes

  • The official rss plugin won't properly work unless you run this new version of degoog.

Breaking Changes

  • The official *rss* plugin will not work unless running degoog version 0.16.0 or later.

Security Fixes

  • API key protection for search and search suggestion endpoints mitigates unauthorized access (HMAC-based authentication).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track degoog

Get notified when new releases ship.

Sign up free

About degoog

Search engine aggregator with plugins

All releases →

Related context

Beta — feedback welcome: [email protected]