v0.163.1
smicallef/spiderfootv0.163.1Jun 11, 2026by bep
AI Summary
This release prioritizes security by updating dependencies and fixing vulnerabilities. It includes improvements to file handling by removing symbolic links and fixes to the convert command and render segments merging behavior.
Key Highlights
- Security updates including upstream fixes in golang.org/x/image.
- Fixed multi --renderSegments merge behavior.
- Security: Normalized integer IPv4 host encodings in http.urls check.
- Removed symbolic links support in os.ReadDir, os.ReadFile, os.Stat, and os.FileExists.
- Fixed convert command.
Breaking Changes
- Dropped symbolic links support in os.ReadDir, os.ReadFile, os.Stat, and os.FileExists
Full Release Notes
The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive [security model](https://gohugo.io/about/security/) as their baseline. Just take a look at Go's recent [security issue list](https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity) to see a demonstration of this. ## What's Changed * build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3 @dependabot[bot] * Fix multi --renderSegments merge behavior 95e5e9f4 @bep #15024 * security: Normalize integer IPv4 host encodings in http.urls check a00b5c72 @bep * Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f93 @bep #15019 * commands: Fix convert command 2602796c @jmooring #15012