Skip to content

degoog

v0.22.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Privacy & Ad-blocking
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

aggregator degoogle degoogle-your-life degoogling search-engine self-hosted

Affected surfaces

auth

Summary

AI summary

Mandatory password for settings added; warnings and documentation updated for security.

Full changelog


Join our discord community


Attention

This version makes having a password for settings mandatory.
It's not gonna change anything to you, on startup degoog will give you a temp password until you decide to either set your own or PURPOSELY not set a password by using DEGOOG_DANGEROUSLY_NO_PASSWORD=true.

There has been an incident #197 , a user didn't know hardening was necessary when exposing degoog to the internet, so we're making sure things are a little safer from the get go :)

Changelog

features

  • People also search for sidebar item has now been refactored to use the installed autocomplete extensions instead of hardcoding it to google as it used to be
  • Added grid utilities for extension/theme devs - Thank you @dev-inside
  • lang is now injected dynamically on engines so localisation works better, this is still up to the individual engines, but should be more consistent
  • Theme assets are now heavily cached, so custom themes should load much faster
  • Wikipedia slot now ALWAYS shows images
  • Allow transports to store values in Valkey/internal cache, this makes it so the 4play plugin uses valkey to store cookies/sessions rather than the /tmp folder
  • Add "shortcuts" as an extension type, allowing users to create/install custom shortcuts in their degoog instances #183
  • Add mandatory password, degoog will suggest a temp one on startup, each startup will have a randomly generated new password
  • Add setting presets on the server settings page, this will allow you to quickly set your instance for a pre-set usage type
  • Add a new settings schema type for plugin list which will a repeatable set of fields for extensions (p.s. apps drawer will use it from now on). This will also allow to build stuff like #199

bugfixes

  • Test connection now doesn't need to save the modal, it'll test the value of the inputs
  • Auto-save now shows success/failure, reverts on errors, and emits save events for the indexer toggle.
  • Fonts moved to WOFF2
  • Fix inconsistent search scoring system
  • Fixed character unicode issue in google rich suggestion autocomplete (and all autocompletes going forward #194)

security

  • Due to an incident (Read pr description in #197 ) we decided to add some comments to all docker compose files, docs and add a few warnings on the start up logs and at the end of the wizard reminding users that an env variable with password/public instance flag is required in the moment your instance reaches the internet, or you WILL be exposed to all sort of nasties - Thank you @Panonim

Breaking Changes

  • Having a password for settings is now mandatory; startup generates a temporary password if none is set.

Security Fixes

  • Added warnings and comments in Docker compose files, docs, and startup logs reminding users to set a password/public instance flag when exposing degoog to the internet.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track degoog

Get notified when new releases ship.

Sign up free

About degoog

Search engine aggregator with plugins

All releases →

Related context

Beta — feedback welcome: [email protected]