Tgbjr2025/grindrx

v0.1.6 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo Privacy & Ad-blocking

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

android grindr privacy sveltekit tauri

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 2mo

The release patches a critical SSRF vulnerability by enforcing a DNS‑hierarchy allowlist on authenticated image fetches. It also resolves WebSocket reconnection issues and introduces several new features.

Why it matters: CVE severity not specified; patch immediately to prevent SSRF attacks via authenticated image endpoints.

Summary

AI summary

SSRF security fix adds a DNS‑hierarchy allowlist for authenticated image fetches.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	SSRF security fix – DNS-hierarchy allowlist on authenticated image fetch SSRF security fix – DNS-hierarchy allowlist on authenticated image fetch Source: llm_adapter@2026-05-27 Confidence: high	—
Feature
Feature	Low	Adds typed WebSocket event handlers: retract, reaction, read receipts, typing indicator Adds typed WebSocket event handlers: retract, reaction, read receipts, typing indicator Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Low	Shows "This message was deleted." for retracted messages Shows "This message was deleted." for retracted messages Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Low	Adds new block/unblock API (`/v4/blocks`) Adds new block/unblock API (`/v4/blocks`) Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Low	Adds new tap API (`/v3/taps`) Adds new tap API (`/v3/taps`) Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Low	Inline form error display on sign-up and password reset Inline form error display on sign-up and password reset Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Low	Adds typing indicator in chat navigation bar Adds typing indicator in chat navigation bar Source: llm_adapter@2026-05-27 Confidence: high	—
Performance	Low	Bulk profile fetch cache reduces redundant API calls Bulk profile fetch cache reduces redundant API calls Source: llm_adapter@2026-05-27 Confidence: high	—
Bugfix	Medium	WS reconnect loop fixed — no more dropped messages on reconnect WS reconnect loop fixed — no more dropped messages on reconnect Source: llm_adapter@2026-05-27 Confidence: high	—

Full changelog

Full two-round audit with 16 critical + 17 high + 19 medium fixes.

Highlights

WS reconnect loop fixed — no more dropped messages on reconnect
SSRF security fix — DNS-hierarchy allowlist on authenticated image fetch
Typed WebSocket event handlers: retract, reaction, read receipts, typing indicator
Retracted messages show "This message was deleted."
New block/unblock API (/v4/blocks)
New tap API (/v3/taps)
Bulk profile fetch cache — fewer redundant API calls
Inline form error display on sign-up and password reset
Typing indicator in chat nav bar
All 40 TypeScript tests + 2 Rust tests passing

⚠️ Newer version available: see v0.1.7

Security Fixes

SSRF security fix — added DNS‑hierarchy allowlist on authenticated image fetch endpoint

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Tgbjr2025/grindrx

Get notified when new releases ship.

About Tgbjr2025/grindrx

All releases →

Related context

Related tools

Earlier breaking changes

v0.1.7 Application renamed from GrindX to GrindrX
v0.1.7 App renamed from GrindX to GrindrX across all surfaces