ScuroNeko/Laniakea
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Releases 27 Wiki Activity

(security): auto-generate webhook secret when unset, redact token in tgapi standalone logs (fix): webhookLogger nil panic, dead warning block (tests): update secret-path test for new auto-gen behaviour (doc): CHANGELOG v1.0.1

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ScuroNeko
2026-06-11 13:33:34 +03:00
co-authored by Claude Sonnet 4.6
parent 5514665625
commit 9e3450df31
7 changed files with 42 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+6
View File
@@ -1,5 +1,11 @@
# Changelog
## v1.0.1
### Fixed
- Fixed webhook always accepting unauthenticated requests when `SecretToken` is not configured. A cryptographically random 32-byte token is now generated automatically when `SecretToken` is empty, so the webhook endpoint is always authenticated. The generated token is logged as a warning so the operator can record it.
- Fixed `tgapi.NewAPI` and `tgapi.NewUploader` not installing token redaction on their managed loggers. The bot token is now masked as `<TOKEN>` in debug output even when the `tgapi` package is used standalone without the `laniakea.Bot` wrapper.
## v1.0.0
### Breaking Changes