diff --git a/CHANGELOG.md b/CHANGELOG.md index dfa4be3a4d3..23e85e46260 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,32 +7,56 @@ The format is based on [*Keep a Changelog*](https://keepachangelog.com/en/1.0.0/ ## [Unreleased] + + +## [v0.107.78] - 2026-07-13 + +See also the [v0.107.78 GitHub milestone][ms-v0.107.78]. + ### Security +- AdGuard Home is now more resistant to JIGGLE attacks. + + This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue. + +- AdGuard Home now validates responses from DoH upstreams more strictly. + + This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue. + +- QUIC connections are now protected from unbounded reads. + + This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue. + +- AdGuard Home now validates responses from DNSCrypt upstreams more strictly. + - The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See [RFC 9113][rfc9113]. - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.5][go-1.26.5]. - The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves. + We thank Damir (@Evelynkaz) for reporting this security issue. + ### Added - Improved updater logging to give users more insight into the problem with version updating ([#8410]). ### Changed -- The interval of filter updates can now be set to any number of ours between 0 and 365 days in the configuration file. +- The interval of filter updates can now be set to any number of hours between `0` and `8760` (365 days) in the configuration file. #### Configuration changes @@ -52,9 +76,7 @@ NOTE: Add new changes BELOW THIS COMMENT. [go-1.26.5]: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc [rfc9113]: https://datatracker.ietf.org/doc/html/rfc9113 - +[ms-v0.107.78]: https://github.com/AdguardTeam/AdGuardHome/milestone/113?closed=1 ## [v0.107.77] - 2026-06-01 @@ -80,6 +102,12 @@ See also the [v0.107.77 GitHub milestone][ms-v0.107.77]. See also the [v0.107.76 GitHub milestone][ms-v0.107.76]. +### Security + +- QUIC connections now observe timeouts more strictly. + + This is GHSA-73vv-3434-p64c. We thank @N0zoM1z0 for reporting this security issue. + ### Changed - Duration values in YAML configuration file now support `d` (days) units and has been updated. @@ -217,7 +245,7 @@ See also the [v0.107.72 GitHub milestone][ms-v0.107.72]. - AdGuard Home now tracks the TLS certificate and key files for updates and reloads them after any updates are detected ([#3962]). -- New query parameter `recent` in `GET /control/stats/` defines statistics lookback period in millieseconds. See `openapi/openapi.yaml` for details. +- New query parameter `recent` in `GET /control/stats/` defines statistics lookback period in milliseconds. See `openapi/openapi.yaml` for details. - New field `"ignored_enabled"` in `GetStatsConfigResponse` or `GetQueryLogConfigResponse`. See `openapi/openapi.yaml` for details. @@ -3670,11 +3698,12 @@ See also the [v0.104.2 GitHub milestone][ms-v0.104.2]. [ms-v0.104.2]: https://github.com/AdguardTeam/AdGuardHome/milestone/28?closed=1 -[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.77...HEAD +[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.78...HEAD +[v0.107.78]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.77...v0.107.78 [v0.107.77]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.76...v0.107.77 [v0.107.76]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.75...v0.107.76 [v0.107.75]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.74...v0.107.75