web-v0.13.0 v2.11.6
Gerstep/cybosOct 1, 2026 → Oct 1, 20260 days between releases
What's New
Introduces URLPattern matching and security hardening, but requires Go 1.26 and enforces stricter header limits.
Breaking Changes
- Go 1.26 is now the minimum version
- Request headers limited to 16 KiB by default
- New 1-minute idle read/write timeouts by default
- Request header fields containing '.' are now dropped
- Wildcard site client_auth inheritance change
New Features
- New url_pattern request matcher
- Slowloris mitigation with idle timeouts
- New tls_automate_names global option
- HTTP/3 over low-MTU links support
- Reverse proxy improvements (partial responses, half-close)
Improvements
- Security hardening and reverse proxy enhancements
- Go version bumped to 1.26
- TLS automation options added
Upgrade Notes
Upgrade to Go 1.26 and verify header sizes are under 16 KiB. Review idle timeouts and ensure header field names do not contain dots. Check wildcard site client_auth inheritance settings.
The Two Releases
web: v0.13.0
Oct 1, 2026· 21 days ago
This release introduces Hermes Agent headless CLI support, adds location filtering and pipeline Sankey diagrams to the web interface, and implements a shared theme provider. It also includes numerous bug fixes for job scanning, PDF generation, and tracker handling.
Full release notesv2.11.6
Oct 1, 2026· 21 days ago
This release introduces URLPattern matching, slowloris mitigation with idle timeouts, and new TLS automation options. It also includes significant breaking changes related to Go version requirements, header sizes, and security hardening.
Full release notes