magdevandClaude Opus 5
d0a2feff20
Finding 41 of bau-pm's v0.22.3 security review called this a pin to move. It is not a pin: both bases here are floating tags, so what ships is whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8, past five October CVEs - none of them reachable in a static file server configured like this one, which is why --pull is the fix rather than a pin. The CI build gets it too: a gate running against a months-old cached base is not testing what the release builds. A release is what applies this. The running image does not change until one is cut. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
23 lines
2.5 KiB
Markdown
23 lines
2.5 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [Unreleased]
|
|
|
|
### Security
|
|
|
|
- The CI and release builds pull their base images fresh (`docker build --pull`). Both bases are floating tags, so what shipped was whatever the runner had cached: v0.1.0 went out with nginx 1.31.6 while the tag had already moved to 1.31.8, past five October CVEs. None of the five is reachable in a static file server configured like this one, which is why this is the fix rather than a pin. From bau-pm's v0.22.3 security review, finding 41 (bau-pm BAU-191). **A release is what applies it** - the running image does not change until one is cut.
|
|
|
|
## [0.1.0] - 2026-10-10
|
|
|
|
The first release: BentoPDF v2.8.8 for bau-pm, about 120 PDF tools that run in the browser and talk to no third party, with the hand-off that brings a PDF from bau-pm into a tool and the result back.
|
|
|
|
### Added
|
|
|
|
- BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's air-gapped build options: Simple Mode, German by default, every module served from the image's own `/wasm/`, the CORS proxy off.
|
|
- The CDN modules vendored and checked against `vendor.lock` (PyMuPDF, Ghostscript, CoherentPDF, Tesseract with German, French, Italian and English, the OCR font, the PDF editor's Latin, Arabic and Hebrew fallback fonts). Ghostscript is served as its whole package with `gs.js` and `gs.wasm` linked at its root, because BentoPDF's own loader and PyMuPDF's wrapper expect the two different layouts (upstream's air-gap layout left `pdf-to-docx` with a 404).
|
|
- A Content-Security-Policy without any host, `img-src` included; the build fails if one survives.
|
|
- `digital-sign-pdf` and `timestamp-pdf` disabled: both need a third party by design.
|
|
- The hand-off glue on every page: a source link (AGPL), the hand-in of a file from bau-pm through a one-minute cookie into the tab's `sessionStorage`, confirmed by the tool's own reaction and retried while it has none (BentoPDF attaches its listener late, and its service worker made the glue win that race), the hand-back of a result caught in every window, the viewer's frame included, and waiting for the hand-off's details when a save comes before them, and the signing tool's flatten switch locked on.
|
|
- The zero-host gate (`test/zero-hosts.mjs`) over every tool page, in CI and in the release workflow.
|