0.9.0 v0.0.19
low risk
facebook/astryxSep 9, 2026 → Sep 10, 20260 days between releases
What's New
Minor version release introduces security patches and plugin sandbox improvements without breaking changes.
New Features
- Sandbox now uses a CSPRNG for improved randomness.
- Plugins can now perform managed media ingestion.
- Media uploads are protected by an SSRF-safe fetch guard.
Improvements
- General security patches included in this release.
- Plugin SDK now correctly carries contentAccess from config.
- Site import now preserves alt text, script order, and folder structure.
Bug Fixes
- Fixed path containment logic to use relative() instead of string prefix.
- Fixed media ingestion to route storage uploads through the SSRF guard.
- Fixed content access propagation in the plugin manifest.
- Fixed site import to honour alt text, script order, and folders.
Upgrade Notes
No specific configuration changes or migration steps are required based on the provided release notes.
The Two Releases
0.9.0
Pingora 0.9.0
Sep 9, 2026· 1 month ago
A major proxy update focusing on connection pooling rework, security hardening, and HTTP parsing improvements.
Full release notesv0.0.19
Instatic 0.0.19
Sep 10, 2026· 1 month ago
Security-focused release with plugin sandbox improvements and media ingestion fixes.
Full release notes