Starstruk Logo MarkStarstruk

11.0.283

chenglou/pretext11.0.283Jun 25, 2026by adubovikov

AI Summary

This is a critical security release addressing three coordinator advisories, including SQL injection fixes, hardcoded password removal, and JWT enforcement requirements.

Key Highlights

  • Closed three coordinator security advisories (GHSA-f46q-3v67-fmm4, GHSA-6xp5-7rcx-xfgx, GHSA-rqcc-94gv-wjm9)
  • Removed hardcoded default admin password 'sipcapture' and implemented random bootstrap passwords
  • Enforced JWT authentication on protected routes when the secret is empty
  • Added comprehensive Security hardening documentation

Breaking Changes

  • API now requires authentication when `coordinator.jwt.secret` is empty
  • Fresh installs without admin hash will log a bootstrap password once at startup

Full Release Notes

## Security release

This release closes three coordinator security advisories. See [docs/SECURITY.md](https://sipcapture.github.io/homer/SECURITY/) for upgrade notes.

### Fixes
* **GHSA-f46q-3v67-fmm4** — validate `rawquery` in `POST /api/v4/statistics/query` (read-only SQL only) ([#837](https://github.com/sipcapture/homer/pull/837))
* **GHSA-6xp5-7rcx-xfgx** — remove hardcoded default admin password `sipcapture`; random bootstrap password when hash omitted ([#838](https://github.com/sipcapture/homer/pull/838))
* **GHSA-rqcc-94gv-wjm9** — enforce JWT on protected routes when `coordinator.jwt.secret` is empty; auto-persist `.homer_jwt_secret` ([#839](https://github.com/sipcapture/homer/pull/839))

### Documentation
* Add [Security hardening](https://sipcapture.github.io/homer/SECURITY/) guide; update auth, coordinator, wizard, and OpenAPI docs.

### Upgrade notes
* **Docker Compose** (`examples/docker/`) with explicit `JWT_SECRET` and `ADMIN_PASSWORD_HASH` — no credential changes.
* **Empty JWT secret** — API now requires authentication; check coordinator logs for `jwt_secret_file`.
* **Fresh install without admin hash** — bootstrap password logged once at startup.

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.281...11.0.283