v2.1.2

What's Changed

• fix: arbitrary file write GHSA-vvmv-wrvp-9gjr
• fix: screenshot of localhost web services (add BLOCK_LIST env) GHSA-342q-2mc2-5gmp

Thank You

@realArcherL for reporting and fixing these issues

Full Changelog: v2.1.0...v2.1.2

v2.1.0

What's Changed

• feat: configurable default screenshot configurations in #49 (resolves #37)
• feat: publish to npmjs.org at @jmondi/url-to-png

pnpm add @jmondi/url-to-png

Full Changelog: v2.0.3...v2.1.0

v2.0.3 - Security Update

Release Notes - Security Update

• fix(security): require screenshot protocol to be http/https by @jasonraimondi in #48
  • Resolved a critical arbitrary file read vulnerability in the Playwright screenshot feature.
  • The vulnerability allowed attackers to read arbitrary files on the server using the file:// URI scheme.
  • Restricted URI schemes to only allow http and https for the screenshot feature.
  • Implemented strict input validation and sanitization to ensure only allowed URIs are processed.

This release addresses a severe security issue and is highly recommended for all users. Please update to the latest version as soon as possible to protect your application and sensitive data.

Thank You

Thank you to @timoxoszt for his contribution in finding and reporting this vulnerability.

Full Changelog: v2.0.2...v2.0.3

v2.0.2

What's Changed

• feat: safe url support by @virgoone in #45

New Contributors

• @virgoone made their first contribution in #45

Full Changelog: v2.0.1...v2.0.2

v2.0.1

What's Changed

• fix: fix incorrect cropped when width or height are omitted by @AnnatarHe in #44
• chore(deps): bump hono from 4.1.3 to 4.2.7 by @dependabot in #42

Full Changelog: v2.0.0...v2.0.1

v2.0.0

What's Changed

• feat: app test suite 🎉 - link
• feat: add documentation site - link
• feat: add optional /metrics endpoint for prometheus / autoscalers - link
• feat: add optional server encryption - link
• feat: add a bunch more server configuration options including log level, pool configurations, cache control, etc.
• refactor: rewrite removing nestjs by @jasonraimondi in #36
  • esm + typescript + decorators = headache and rewriting to hono was just more fun and easier
• docs: update README.md with the updated AWS variables by @enstyled in #32

Breaking Changes

• The default port has switched from 3000 to 3089. To keep using port 3000, use PORT=3000
• AWS_ACCESS_KEY has been replaced with AWS_ACCESS_KEY_ID
• AWS_SECRET_KEY has been replaced with AWS_SECRET_ACCESS_KEY
• AWS_REGION has been replaced with AWS_DEFAULT_REGION

New Contributors

• @enstyled made their first contribution in #32

Full Changelog: v1.5.0...v2.0.0

v1.5.0 - Local filesystem caching

What's Changed

• feat: add local filesystem storage provider by @jasonraimondi in 813d05b
• feat: add aws endpoint support, improve aws naming conventions by @jasonraimondi in 3c4cc29
• ci: Use GITHUB_OUTPUT envvar instead of set-output command by @arunsathiya in #27

New Contributors

• @enstyled thanks to for requesting some useful feature requests
• @arunsathiya automated their first contribution in #27

Full Changelog: v1.4.2...v1.5.0

v1.4.2

Notes

ops(feat): deploy to ghcr #25

Full Changelog

v1.4.1...v1.4.2

v1.4.1

Notes

chore(deps): bump sharp from 0.32.1 to 0.32.6 #24

Full Changelog

v1.4.0...v1.4.1

v1.4.0

chore: bump nodejs v12 to v20
chore: bump aws sdk from v2 to v3
chore: bumps all dependencies