github.com/pilinux/gorest

What's Changed

• chore: bump indirect dependencies in 1c37216
• chore(deps): bump gorm.io/driver/postgres from 1.6.0 to 1.6.2 by @dependabot[bot] in #417
• chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @dependabot[bot] in #419
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #420
• refactor(cors): drop redundant preflight abort in 601778c
• fix(deps): drop rs/cors/wrapper/gin nested module in 719d9ca
• chore(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 by @dependabot[bot] in #421
• chore(deps): bump github.com/pilinux/crypt from 0.0.23 to 0.0.24 by @dependabot[bot] in #422
• chore(deps): bump go.mongodb.org/mongo-driver/v2 from 2.8.0 to 2.8.2 by @dependabot[bot] in #424
• chore(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 by @dependabot[bot] in #425
• chore(deps): bump github.com/getsentry/sentry-go/logrus from 0.48.0 to 0.49.0 by @dependabot[bot] in #426

Full Changelog: v1.13.2...v1.13.3

What's Changed

• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #405
• chore(deps): bump go.mongodb.org/mongo-driver/v2 from 2.7.0 to 2.8.0 by @dependabot[bot] in #406
• chore(deps): bump github.com/pilinux/twofactor from 1.1.13 to 1.1.14 by @dependabot[bot] in #409
• chore(deps): bump github.com/pilinux/argon2 from 0.24.0 to 0.25.0 by @dependabot[bot] in #407
• chore(deps): bump github.com/pilinux/crypt from 0.0.19 to 0.0.20 by @dependabot[bot] in #408
• deps(ci): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #412
• chore(deps): bump github.com/getsentry/sentry-go/logrus from 0.47.0 to 0.48.0 by @dependabot[bot] in #410
• chore(deps): bump github.com/pilinux/crypt from 0.0.20 to 0.0.23 by @dependabot[bot] in #414

Full Changelog: v1.13.1...v1.13.2

What's Changed

• fix: handle case-insensitive env values (8de51c8)
• fix(config): load JWT priv/pub key independently (ed33828)
• chore(deps): bump gorm.io/gorm from 1.31.1 to 1.31.2 by @dependabot[bot] in #404

Full Changelog: v1.13.0...v1.13.1

Highlights

⚡ asymmetric JWT keys can now be loaded independently

For ECDSA/EdDSA/RSA algorithms, PRIV_KEY_FILE_PATH and PUB_KEY_FILE_PATH are no longer both required.
Whichever key is provided is loaded; only when both are missing does configuration fail.
This enables signer-only (private key) and verifier-only (public key) deployments.

⚡ environment variables are now matched case-insensitively

Keyword/enum values that are compared against fixed literals downstream are normalized so casing no longer matters:

• JWT_ALG: eddsa, Es256, HS256 all resolve to the canonical name the JWT library expects
• DBSSLMODE: disable / require / verify-ca / verify-full
• LISTTYPE: whitelist / blacklist
• MONGO_MONITOR_POOL: yes / no
• EMAIL_TRACK_OPENS: yes / no
• DBCONNMAXLIFETIME: duration units (1H, 2H30M, 30S now accepted)
• IP: firewall list

⚡ firewall IP matching hardened

Exact (non-CIDR) IP entries are normalized via net.ParseIP so IPv6 addresses match the client
regardless of case (2001:DB8::1) or form (2001:db8:0:0:0:0:0:1); invalid entries are skipped
instead of being stored as dead keys.

Summary

This release is a large security-hardening and robustness pass across the auth,
2FA, crypto, database, and middleware layers. It tightens cryptographic
defaults, makes Redis/DB state changes atomic, bounds and hardens the random/
crypto helpers, reworks the Sentry integration, and threads context.Context
through handlers. It also refreshes dependencies and the agent-facing docs.

Full Changelog: v1.12.4...v1.13.0

Highlights

• Stronger crypto defaults: minimum 32-character HMAC secrets and overflow-safe
  Argon2 memory configuration.
• Brute-force protection for 2FA backup codes and password-recovery attempts.
• Atomic Redis/DB operations across login/logout, email verification, email
  update, password reset, and 2FA flows.
• Hardened random-number and validation utilities (SecureRandomNumber,
  ValidateEmail, ValidatePath, FileExist).
• Reworked Sentry logrus hook with request-context propagation and panic
  recovery.
• Handlers now accept context.Context, honoring client cancellation and
  deadlines end-to-end.

Breaking changes & upgrade notes

• Handlers now take context.Context as their first argument. Controllers
  pass c.Request.Context(). Update any direct calls to handler.*,
  service.SendEmail, and service.IsTokenAllowed to pass a context.
  dcf5083
• Minimum 32-character HMAC secrets are enforced. Deployments using shorter
  ACCESS_KEY / REFRESH_KEY values must lengthen them. 10a17fb
• SERVE_JWT_AS_RESPONSE_BODY now defaults to disabled. Set it explicitly if
  your clients expect tokens in the response body. 42ba45a
• Generic auth errors in production. In prod, auth failures return generic
  messages and verification status is exposed only to the account owner.
  e030018, 1cb8298, a33ab7b

Security & hardening

• 10a17fb enforce minimum 32-character secrets for HMAC signing
• 37a2208 load JWT private/public key files when required (asymmetric algos)
• 42ba45a default SERVE_JWT_AS_RESPONSE_BODY to disabled
• a10c24f guard HASHPASSMEMORY against uint32 overflow
• 1cb8298 constant-time login path for unknown email addresses
• e030018 return generic auth errors in production
• a33ab7b reveal email verification status only to the account owner
• 87c4843 nil-safe resp.Message check in controllers
• e5b8a3a guard structs.Map against non-struct data

Authentication & 2FA

• 064dcdc add a 2FA recovery-attempt limiter
• b76f862 limit 2FA backup-code brute-force attempts
• 2210307 widen the 2FA recovery-key charset for more entropy
• 63ba198 clear in-memory 2FA state on deactivate
• d33e016 unify the 2FA backup-code response shape
• 2e683a4 skip blacklisting already-expired tokens

Data integrity (atomic operations)

• 3142ddc store verification/recovery codes in Redis atomically with TTL
• 321d201 set logout blacklist key and TTL atomically
• c11ef48 consume the verification code atomically
• cbbb1f6 update email within a single transaction
• dad5c89 atomic password reset + 2FA update
• 43ad32f atomic 2FA + password update in PasswordUpdate
• 1ae6acb handle empty HGET result in PasswordRecover
• 74c3792 drop redundant EXISTS check in PasswordRecover
• d82b9cc send recovery email asynchronously in production

Crypto & utility library

• 6c9738f compute random numbers with big.Int.Exp
• 9333052 fix SecureRandomNumber endpoints and bound edge cases
• e9d648f guard SecureRandomNumber against uint64 overflow
• a2bfb03 bound the SecureRandomNumber retry loop
• d1b8e89 bound the ValidateEmail MX lookup with a timeout
• e2f5ac6 document that ValidateEmail skips the RFC 5321 implicit-MX fallback
• 38ccfae prevent an out-of-range panic
• 7460350 FileExist returns true only on a successful stat
• 53c100d resolve symlinks in ValidatePath
• ae4f9a1 support colon-containing values in the email HTML model
• efca1c5 fix the StrArrHTMLModel example separator in docs

Middleware, renderer & firewall

• 9f9e595 rework the Sentry logrus hook to reliably capture events
• dcf5083 thread request context into logs for Sentry
• 09f42a2 isolate firewall state per instance
• 16f62b7 match firewall wildcard as an exact entry
• 50587f8 apply the status code to HTML responses
• 91e9abb honor media range and q-value during content negotiation

Database

• 73ccb5a use the mysql driver to build the DSN
• 3a808ae use libpq keyword/value DSN format
• ea6eb03 CloseAllDB aborts on the first error
• 8ed885c drop shared err/sqlDB globals
• 98ab74c nil-guard the db/redis client getters

Examples

• c93b78f split public/auth route groups in the router example
• 5b9b24d atomic user-delete cascade (example2)
• 0473fd0 batch-load posts/hobbies in GetUsers (example2)
• 02b419d validate userID in GetUser (example)
• 4cefe43 nil-guard db/redis/mongo getters in the examples

Observability (Sentry)

• 9f9e595 reworked Sentry logrus hook
• dcf5083 request-context propagation into Sentry logs
• 2779b9f more Sentry test coverage
• 1af2d85 automatic recovery from panic
• b7b765a CI: run the Sentry test with an actual DSN

Dependencies

• 3033429 bump golang.org/x/crypto 0.52.0 → 0.53.0 (#397)
• ca2615b bump go.mongodb.org/mongo-driver/v2 2.6.0 → 2.6.1 (#399)
• 3db4b37 bump go.mongodb.org/mongo-driver/v2 2.6.1 → 2.7.0 (#403)
• 0c1f2f2 bump codecov/codecov-action 6 → 7 (#398)
• a33115b bump actions/checkout 6 → 7 (#402)

Docs, tests & chores

• 871de65 add CLAUDE.md
• 9f2ba3d sync agent docs (AGENTS.md, llms.txt, skills) with current code
• 78cd28e fix error-code ranges in the README table
• 50e1373 fix go doc formatting
• 448e856 cover key-path errors for asymmetric JWT (tests)
• 0a8cd01 fix issues #400 and #401

What's Changed

• chore(vulnerability fix): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 by @dependabot[bot] in #396

Full Changelog: v1.12.3...v1.12.4

Highlights

• Added DB_URI support for SQL database connections in c5c750b
• Added REDIS_URI support for Redis connections in 0439ac9
• Updated several dependencies, including security-related upstream packages
  • chore(deps): bump github.com/pilinux/argon2 from 0.23.0 to 0.24.0 by @dependabot[bot] in #393
  • chore(deps): bump github.com/pilinux/twofactor from 1.1.12 to 1.1.13 by @dependabot[bot] in #394
  • chore(deps): bump github.com/pilinux/crypt from 0.0.18 to 0.0.19 by @dependabot[bot] in #392
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #395
• Improved GitHub issue and PR templates for clearer contributor reports in ca00e66

What changed

SQL connection URI support

You can now configure SQL connections with a single DB_URI value.

Behavior:

• If DB_URI is set, gorest uses it directly.
• If DB_URI is empty, gorest keeps using the existing field-based settings such as DBHOST, DBPORT, DBNAME, DBUSER, and DBPASS.

Supported drivers:

• mysql
• postgres
• sqlite3

Examples:

DB_URI=postgresql://user:password@host:port/db?sslmode=require&channel_binding=require

Why this matters:

• Easier deployment on platforms that provide a single database URL
• Simpler container and cloud configuration
• Better compatibility with managed database providers

Redis connection URI support

You can now configure Redis with REDIS_URI.

Behavior:

• If REDIS_URI is set, gorest uses it directly.
• If REDIS_URI is empty, gorest falls back to REDISHOST and REDISPORT.

Example:

REDIS_URI=redis://user:password@host:port

Why this matters:

• Easier integration with hosted Redis services
• Cleaner production configuration
• Less manual env assembly

Compatibility

This release is backward-compatible.

Existing setups that use:

• DBHOST, DBPORT, DBNAME, DBUSER, DBPASS
• REDISHOST, REDISPORT

will continue to work unless you choose to adopt DB_URI or REDIS_URI.

Full Changelog: v1.12.2...v1.12.3

What's Changed

• chore(deps): bump github.com/flosch/pongo2/v6 from 6.0.0 to 6.1.0 by @dependabot[bot] in #384
• chore(deps): bump github.com/getsentry/sentry-go/logrus from 0.46.1 to 0.46.2 by @dependabot[bot] in #386
• chore(deps): bump github.com/mrz1836/postmark from 1.9.1 to 1.9.2 by @dependabot[bot] in #387
• chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #388
• chore(deps): bump github.com/mediocregopher/radix/v4 from 4.1.4 to 4.1.5 by @dependabot[bot] in #390
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #389
• 修复InMemorySecret2FA全局map竞态条件 by @saaa99999999 in #391 (🛠️ vulnerability fix)
• ci: fix staticcheck error in b898802
• ci: new test functions in 94cedf1

New Contributors

• @saaa99999999 made their first contribution in #391

Full Changelog: v1.12.1...v1.12.2

What's Changed

• chore(deps): bump github.com/getsentry/sentry-go/logrus from 0.43.0 to 0.44.1 by @dependabot[bot] in #366
• chore(deps): bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in #368
• chore(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2 by @dependabot[bot] in #378
• chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @dependabot[bot] in #371
• chore(deps): bump go.mongodb.org/mongo-driver/v2 from 2.5.0 to 2.6.0 by @dependabot[bot] in #381
• chore(deps): bump github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0 by @dependabot[bot] in #382
• chore(deps): bump github.com/getsentry/sentry-go/logrus from 0.44.1 to 0.46.1 by @dependabot[bot] in #379
• chore(deps): bump github.com/mrz1836/postmark from 1.9.0 to 1.9.1 by @dependabot[bot] in #383

Full Changelog: v1.12.0...v1.12.1

Highlights

This release focuses on security hardening, test coverage expansion, and dependency upgrades. The minimum Go version is now 1.25.0. A directory traversal vulnerability in configuration loading has been fixed, nil pointer dereferences in database initialization have been resolved, and new test codes have been added across the database/, config/, lib/, and lib/renderer/ packages.

---

Breaking Changes

• Go 1.25.0 is now required. The go directive in go.mod has been upgraded from 1.24.1 to 1.25.0 (b89c241).

---

Security

• Fix directory traversal vulnerability in config loading (4771052). The security() and view() config functions previously accepted unsanitized paths for the 2FA QR directory and template directory. A new ensureConfigDir() / sanitizeConfigDir() pipeline now validates that configured paths remain within the workspace root, preventing directory traversal attacks.

• Harden lib.ValidatePath() (96be3cd). The path validation function has been rewritten to use filepath.Rel instead of string-prefix matching, which is more robust against edge cases. Empty inputs are now explicitly rejected, and both the full path and allowed directory are cleaned and resolved to absolute paths before comparison.

---

Bug Fixes

• Fix nil pointer dereference in database initialization (42e50af). InitDB(), InitRedis(), InitMongo(), and InitTLSMySQL() now check whether config.GetConfig() returns nil before dereferencing it, preventing panics when the configuration has not been initialized.

• Fix linter error-check warning (0889239). An unchecked error return was corrected to satisfy static analysis requirements.

---

Refactoring

• Extract ensureConfigDir and sanitizeConfigDir (96be3cd, 6cd9468). Duplicated directory-creation logic in the security() and view() config functions has been consolidated into two reusable helpers, reducing code duplication and centralizing the validation logic.

• Introduce package-level indirections for testability (42e50af). sql.Open, mysql.RegisterTLSConfig, filepath.Abs, and filepath.Rel are now accessed through package-level variables, allowing tests to inject failures without requiring real infrastructure.

---

Test Coverage

This release adds new test codes and significantly improves coverage for previously untested packages.

• Add comprehensive test suite for SQL database initialization: InitDB() and GetDB() covering MySQL, PostgreSQL, and SQLite drivers (4ff31a8).
• Add test cases for InitTLSMySQL() including CA loading, client certificate handling, and TLS registration failures (e821985).
• Add test cases for Redis initialization and connection closure (f926b13).
• Add test cases for MongoDB initialization and connection closure (af9918b).
• Add test cases for CloseSQL(), CloseRedis(), CloseMongo(), and CloseAllDB() (3df555a).
• Add tests for renderer.Render() covering JSON and HTML template rendering paths (d589b8b).
• Improve test coverage for lib.ValidatePath() with edge cases for traversal patterns, empty inputs, and error injection (4298161).
• Improve test coverage for lib.ByteToPNG() with platform-specific test files for Unix (c8e5282).
• Fix platform-specific test build issue where syscall references failed on Windows (e51a5f3).
• Improve mustGetConfig() test helper function (ffac4fa).
• Add config tests covering additional missing environment variable cases (466dd0a).
• Fix test failure caused by missing .env file (d934a34).

---

CI / Infrastructure

• Remove Go 1.24.x from CI matrix; CI now targets Go 1.25.0+ (84efc77).
• Switch to using securego/gosec binary directly instead of go install (2820b34, 1af2183).
• Limit parallel CI runs to avoid resource contention (334b299).
• Add coverage reporting from the database/ (internal) package (3e92b15).
• Ensure newly added files appear in coverage reports (bbba30d).

---

Dependency Updates

Direct Dependencies

Package	Previous	Updated
github.com/gin-gonic/gin	v1.11.0	v1.12.0 (48c7379)
github.com/getsentry/sentry-go	v0.42.0	v0.43.0 (4c1256b)
github.com/getsentry/sentry-go/logrus	v0.42.0	v0.43.0 (4c1256b)
github.com/mrz1836/postmark	v1.8.4	v1.9.0 (dc756ee)
golang.org/x/crypto	v0.48.0	v0.49.0 (918f129)

Indirect Dependencies

Package	Previous	Updated
golang.org/x/arch	v0.24.0	v0.25.0
golang.org/x/net	v0.50.0	v0.52.0
golang.org/x/sync	v0.19.0	v0.20.0
golang.org/x/sys	v0.41.0	v0.42.0
golang.org/x/text	v0.34.0	v0.35.0

---

Documentation

• Update README.md to list Go 1.25.0+ as the requirement for v1.12.x and recommend v1.12.x for new projects (b89c241).
• Update SECURITY.md to mark v1.11.0 as end-of-life with final release v1.11.1, and add v1.12.0 as the currently supported version (b89c241).

---

Full Changelog: v1.11.1...v1.12.0

🐛 Fixes

• fix: out-of-bounds error in cc0070d
• security fix: G117 (CWE-499) in 84945f4
• security fix: addresses G301 (CWE-276) in 7c1f499
• fix: race condition in d5166bc

⚡ Performance

• performance: less memory pressure, less CPU work in 7f90bf8
• performance: use strings.SplitSeq to reduce temporary allocations in f515877

♻️ Improvements / Refactor

• improvement: handle empty time.Time json in go modern way in ce4542c
• refactor: using bson.D in mongo query (example and example2) in faa5fc8
• refactor: sample code for paginated posts (example2) in 3c22c9a

✅ Tests

• tests: prevent closure-capture bugs in 561f229

🤖 CI

• ci: run actions when source code is changed in ce59aea
• gosec: handles false-positive in 37beb42, 21a6adb and 7ad3fa5
• ci: activate all default rules of gosec in f20eb89

📚 Docs

• skills for agents introduced in 9cbefda and documented in bbb4dd4

📦 Dependency Updates

• chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 by @dependabot[bot] in #360
• chore(deps): bump github.com/mrz1836/postmark from 1.8.3 to 1.8.4 by @dependabot[bot] in #359
• chore: bump indirect dependencies (bug fix + security patch) in 2c52b46

🚀 Upgrade Notes

If you are upgrading from v1.10.x, please check the release notes for v1.11.0 and v.1.10.5 for breaking changes and upgrade instructions.

Full Changelog: v1.11.0...v1.11.1

This release introduces significant security enhancements, modernizes the database driver, and includes breaking changes to encryption and dependency management.

🚨 Breaking Changes

• MongoDB Driver Upgrade: Migrated from qmgo (and the official driver v1) to the official MongoDB Go Driver v2. If you are using qmgo or older driver interfaces, you will need to update your database code.
• 2FA Secret Encryption: 2FA secrets are now encrypted exclusively using keys derived from Argon2id. This strengthens the security of stored 2FA tokens.

🛡️ Security & Validation

• NoSQL Injection Prevention:
  • Refactored MongoDB queries in example and example2 to use bson.D (ordered documents) instead of bson.M (unordered maps) for explicit field matching.
  • Added explicit usage of the $eq operator in filters to prevent operator injection attacks.
• Strict Input Sanitization:
  • Implemented strict input validation for geocoding and address data (max length, null-byte checks, UTF-8 validation).
  • Added sanity checks to reject inputs containing MongoDB operator prefixes (e.g., fields starting with $).

🏗️ Refactoring & Improvements

• Architecture: example and example2 applications have been refactored to demonstrate the new strict validation patterns and secure BSON construction.
• Documentation: Updated llms.txt and other documentation to reflect the new repository patterns and security practices.

📦 Dependency Updates

• chore(deps): bump github.com/mrz1836/postmark from 1.8.2 to 1.8.3 by @dependabot[bot] in #357
• chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #358

⚙️ CI/CD

• Updated golangci-lint to v2.9.0
• Removed go report card integration

Full Changelog: v1.10.6...v1.11.0

Compare