This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalVersion v1.16.2 sanitizes comment text in email notifications to fix the GHSA‑74pc‑3r2m‑ppx3 XSS vulnerability.
Why it matters: The release patches a high-severity (severity 90) XSS flaw affecting email notification rendering; operators should upgrade immediately.
Summary
AI summarySanitize comment text in email notifications and close GHSA‑74pc‑3r2m‑ppx3 XSS vulnerability.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Sanitize comment text in email notifications (GHSA-74pc-3r2m-ppx3). Sanitize comment text in email notifications (GHSA-74pc-3r2m-ppx3). Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Add --trusted-proxy option to gate client-IP forwarding headers. Add --trusted-proxy option to gate client-IP forwarding headers. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Dependency | Low |
Update frontend and site dependencies to latest, bump pnpm to 10, clear audit alerts. Update frontend and site dependencies to latest, bump pnpm to 10, clear audit alerts. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Dependency | Low |
Update backend dependencies to latest. Update backend dependencies to latest. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Dependency | Low |
Bump webpack-dev-server from 4.9.3 to 5.2.4 in /frontend. Bump webpack-dev-server from 4.9.3 to 5.2.4 in /frontend. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Dependency | Low |
Bump postcss from 8.4.14 to 8.5.10 in /frontend. Bump postcss from 8.4.14 to 8.5.10 in /frontend. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Make user deletion idempotent for users without comments. Make user deletion idempotent for users without comments. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Warn on catch-all trusted-proxy, cover more cases, trim wording. Warn on catch-all trusted-proxy, cover more cases, trim wording. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Surface real avatar-store errors on deleteme, tolerate only not-found. Surface real avatar-store errors on deleteme, tolerate only not-found. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Remove user avatar on deleteme request. Remove user avatar on deleteme request. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Show UI error when no auth providers are configured. Show UI error when no auth providers are configured. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Guard against falsy outputPath in Eleventy htmlmin transform. Guard against falsy outputPath in Eleventy htmlmin transform. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Handle REST shutdown before server start. Handle REST shutdown before server start. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Replace go-chi/chi router with go-pkgz/routegroup. Replace go-chi/chi router with go-pkgz/routegroup. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Refactor | Low |
Use stdlib http.ServeMux instead of chi in cleanup_test. Use stdlib http.ServeMux instead of chi in cleanup_test. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Consolidate request middlewares into middleware.go. Consolidate request middlewares into middleware.go. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Replace chi middleware.RealIP with rest.RealIP on the main router. Replace chi middleware.RealIP with rest.RealIP on the main router. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Replace chi middleware.NoCache with rest.NoCache on the main router. Replace chi middleware.NoCache with rest.NoCache on the main router. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Replace chi middleware.Timeout with the timeout helper, drop chi/middleware. Replace chi middleware.Timeout with the timeout helper, drop chi/middleware. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Replace chi middleware.Throttle with rest.Throttle on the main router. Replace chi middleware.Throttle with rest.Throttle on the main router. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Migrate ssl.go TLS routers from chi to routegroup. Migrate ssl.go TLS routers from chi to routegroup. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
Improvements
- adopt go-pkgz/rest v1.22.0: CORS Vary + enforcing Timeout, drop local reimplementations #2105 @paskal
- replace go-chi/chi router with go-pkgz/routegroup #2103 @paskal
- replace go-chi/cors with go-pkgz/rest CORS #2102 @paskal
- use stdlib http.ServeMux instead of chi in cleanup_test #2101 @paskal
- consolidate request middlewares into middleware.go #2100 @paskal
- replace chi middleware.RealIP with rest.RealIP on the main router #2099 @paskal
- replace chi middleware.NoCache with rest.NoCache on the main router #2098 @paskal
- replace chi middleware.Timeout with the timeout helper, drop chi/middleware #2097 @paskal
- replace chi middleware.Throttle with rest.Throttle on the main router #2096 @paskal
- migrate ssl.go TLS routers from chi to routegroup #2095 @paskal
- update frontend and site dependencies to latest, bump pnpm to 10, clear audit alerts #2091 @paskal
- update backend dependencies to latest #2088 @paskal
- bump the github-actions-updates group across 1 directory with 4 updates #2092 @app/dependabot
- bump webpack-dev-server from 4.9.3 to 5.2.4 in /frontend #2063 @app/dependabot
- bump postcss from 8.4.14 to 8.5.10 in /frontend #2056 @app/dependabot
Bug Fixes
- sanitize comment text in email notifications (GHSA-74pc-3r2m-ppx3) #2093 @paskal
- add --trusted-proxy to gate client-IP forwarding headers #2116 @paskal
- warn on catch-all trusted-proxy, cover more cases, trim wording #2118 @paskal
- surface real avatar-store errors on deleteme, tolerate only not-found #2113 @paskal
- remove user avatar on deleteme request #2104 @paskal
- make user deletion idempotent for users without comments 3fc5d6b9
- ui error when no auth providers configured 406df022
- guard against falsy outputPath in eleventy htmlmin transform #2094 @paskal
- handle REST shutdown before server start 589e956a
Security Fixes
- GHSA-74pc-3r2m-ppx3 — sanitize comment text in email notifications to prevent XSS
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About remark42
Lightweight and simple comment engine, which doesn't spy on users. It can be embedded into blogs, articles or any other place where readers add comments.
Beta — feedback welcome: [email protected]