This release includes 1 security fix for security teams reviewing exposed deployments.
Published 2mo
Privacy & Ad-blocking
✓ No known CVEs patched
This release patches 1 known CVE
Topics
aggregator
degoogle
degoogle-your-life
degoogling
search-engine
self-hosted
Affected surfaces
auth
breaking_upgrade
Summary
AI summaryFix UI session sync bug and add API key protection for search endpoints.
Full changelog
Changelog
bugfixes
- Fix bug where session expired but UI hadn't caught up, not a real security issue, however it was very annoying for users.
- Fix bug where extension description were not scrollable.
- Add ability to use proxy auth with fetch. NOTE: If your proxy URL omitted the port and your proxy ran on
8080, add :8080 explicitly as proxies default on port 80 by default now (as it should be) #106 - Tabs showing when all engines were disabled
- Tabs not working when searching with a bang for one engine (they should just not show instead) #109
- Allow post search to accept keypairs payloads #108
features
- Change the way the internal image proxy works, server side signs images via HMAC instead of having a list of hardcoded allowed origins, it's smarter and allows for more customisation. That means eventually store engines will deprecate the allowedOrigin array, and they'll only work with degoog 1.15.1 onward.
- Added the ability to protect search and search suggestion endpoints with an api key, this should help a bit with bot control in case, the UI uses the same HMAC system I implemented for proxies, given it was already there may as well make use of it for everything that needs to stay protected. You can check the api section of the documentation to see how to use your api key
- Added a search bar on the left sidebar of the setting page, this will help you navigate in the now MANY settings available. Made this mostly for myself as these settings are getting out of hand lol
- Made a big upgrade to the built in at a glance plugin, it won't always fetch the first result anymore, it's a bit smarter than that, also it'll purposely avoid wikipedia results if you have the wikipedia plugin enabled, so there are no redundancies. Make sure to check the plugin configurations as you can set a few things (e.g. stop it from actually fetching and scraping the search result).
- Add ability to use a
DEGOOG_BASE_URLenv variable if you need to host degoog on specific paths (e.g. example.com/degoog). Bear in mind, this may not work with specific plugins until developers catch up to the change. Leaving it empty will just default to current behaviour so I won't consider it a breaking change.
potential breaking changes
- The official rss plugin won't properly work unless you run this new version of degoog.
Breaking Changes
- The official *rss* plugin will not work unless running degoog version 0.16.0 or later.
Security Fixes
- API key protection for search and search suggestion endpoints mitigates unauthorized access (HMAC-based authentication).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]