Repository navigation
fix(server): random default password, mail upload limit, non-root images, token file mode, pinned release action - #1847
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fclairamb
changed the title
…ead of test/test The config file created when the server starts without -conf no longer declares a test/test account. Its test user gets a random 20-character password, logged once at Warn level when the file is created and stored bcrypt-hashed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ing test/test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Breaking for host mounts owned by another uid: chown them to 65532 or use --user. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…est pinning Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
fclairamb
added a commit
that referenced
this pull request
Oct 30, 2026
🤖 I have created a release *beep* *boop* --- ## [0.16.5](v0.16.4...v0.16.5) (2026-10-30) ### Bug Fixes * always check keycloak credentials, even on shared accesses ([#1848](#1848)) ([9a24e42](9a24e42)) * **deps:** update github.com/fclairamb/ftpserverlib to v0.32.6 ([#1850](#1850)) ([ec4f71b](ec4f71b)) * **server:** nil passive port range crashes passive transfers ([#1845](#1845)) ([b7dbc33](b7dbc33)) * **server:** random default password, mail upload limit, non-root images, token file mode, pinned release action ([#1847](#1847)) ([60645ff](60645ff)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Florent Clairambault <florent.clairambault@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes for the Medium and Low findings of the weekly security scan, each delivered from its spec (now in
specs/done/2026/10/).test/test). Docs and docker test workflow updatedMaxSize(default 25 MiB) instead of buffering without limit--userand mount ownershipgo-release-action,release-please-actionand the semantic-PR action pinned by SHA; Renovate pins digestsAlso: merged
main; PR title scope fixed (securityis not an allowed scope).Breaking changes (changelog note for the release): a fresh start without
-confno longer acceptstest/test; host mounts owned by another uid must be writable by 65532 or use--user.Decided by autopilot
--userdocumented (recommended).Notes: spec 02's
go mod tidyadded testify and shrankgo.sum(~1200 lines); worth a look in review.🤖 Generated with Claude Code