Starstruk Logo MarkStarstruk

11.0.326

sipcapture/homer11.0.326Aug 21, 2026by adubovikov

AI Summary

A comprehensive security release including CSP enforcement, SSRF fixes, and password change enforcement.

Key Highlights

  • Add UI Content-Security-Policy (CSP).
  • Block OAuth avatar SSRF vulnerabilities.
  • Stop storing session JWT in localStorage.
  • Refuse default sipcapture admin password.
  • Force password change after sipcapture login.
  • Validate SQL and require Bearer auth in FlightSQL.

Full Release Notes

## What's Changed
* fix(security): add UI Content-Security-Policy (GHSA-626p-c2xw-r7pg) by @adubovikov in https://github.com/sipcapture/homer/pull/960
* fix(security): block OAuth avatar SSRF (GHSA-h4qr-v7ch-q758) by @adubovikov in https://github.com/sipcapture/homer/pull/961
* fix(security): stop storing session JWT in localStorage (GHSA-rqwc-fmx3-95j8) by @adubovikov in https://github.com/sipcapture/homer/pull/962
* fix(ci): stop using unpinned polyfill-glibc-action:latest (GHSA-7567-57wg-qcvj) by @adubovikov in https://github.com/sipcapture/homer/pull/963
* fix(packaging): pin SHA-256 of bundled DuckDB extensions (GHSA-vqh9-j3rh-cj62) by @adubovikov in https://github.com/sipcapture/homer/pull/965
* fix(docker): non-root runtime and digest-pinned bases (GHSA-9c8w-qvmp-pvjj) by @adubovikov in https://github.com/sipcapture/homer/pull/964
* fix(scripting): sandbox Lua VMs (GHSA-m726-p857-j3cc) by @adubovikov in https://github.com/sipcapture/homer/pull/966
* fix(flightsql): validate SQL and require Grafana Bearer auth (GHSA-w9hq-83jw-w7h9) by @adubovikov in https://github.com/sipcapture/homer/pull/967
* fix(auth): refuse default sipcapture admin password (GHSA-263f-5xrw-c34r) by @adubovikov in https://github.com/sipcapture/homer/pull/968
* fix(auth): force password change after sipcapture login (GHSA-263f-5xrw-c34r) by @adubovikov in https://github.com/sipcapture/homer/pull/970


**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.325...11.0.326