2026-07-24 - 2026-10-24
Overview
8 Pull requests merged by 1 user
Merged
#14 ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7)
Merged
#13 fix(edge): CVE-2026-109618/-109619 multipart mitigations (2026.10.6)
Merged
#12 fix(waf): HTTP/3 bodies were stamped complete when truncated (2026.10.5)
Merged
#11 fix(haproxy): set X-CLIENT-IP instead of adding it
Merged
#9 fix(domain-removal): stop deleting certificates other live sites are served from
Merged
#8 fix(ip-blocking): the runtime map fast path has never once run
Merged
#7 fix(security-stats): stop reporting counters the stick tables never stored
Merged
#6 fix(haproxy): silence the ACL pattern warning on wp_admin_asset
1 Issue closed from 1 user
Closed
#10 Client-supplied IP headers are trusted at the edge: X-Real-IP / CF-Connecting-IP / X-Forwarded-For are not stripped from untrusted peers
1 Issue created by 0 users
Opened
#10 Client-supplied IP headers are trusted at the edge: X-Real-IP / CF-Connecting-IP / X-Forwarded-For are not stripped from untrusted peers