From 0d517482dd4067f30f8b5faac8286f50ea2e50be Mon Sep 17 00:00:00 2001 From: Jan Larwig Date: Wed, 30 Jul 2025 19:58:49 +0200 Subject: [PATCH] add changelog entry for v7.11.0 Signed-off-by: Jan Larwig --- CHANGELOG.md | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c6af8b8c..c8301170 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,9 +12,31 @@ ## Release Highlights +- 🏢 Support for SourceHut (sr.ht) provider +- 🔍️ Support for more fine-grained control over the google admin-sdk scopes and optional google groups +- 🐛 Squashed some bugs + + ## Important Notes -Fixed critical vulnerability where `skip_auth_routes` regex patterns matched against the full request URI (path + query parameters) instead of just the path, allowing authentication bypass attacks. +Firstly, fixed critical vulnerability where `skip_auth_routes` regex patterns matched against the full request URI (path + query parameters) instead of just the path, allowing authentication bypass attacks. + +Secondly, fixed double-escaping of `$` in regexes for Alpha Config upstreams path and rewriteTargets: + +```yaml +# Before +upstreams: + - id: web + path: ^/(.*)$$ + rewriteTarget: /$$1 + +# After +upstreams: + - id: web + path: ^/(.*)$ + rewriteTarget: /$1 +``` + ## Breaking Changes