From 5529fa8da2dfc91adab261d7a0641c671e269983 Mon Sep 17 00:00:00 2001 From: Carlos Panato Date: Fri, 9 Oct 2026 18:02:30 +0200 Subject: [PATCH] Add the webhook hardening and docs changes to the CHANGELOG Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Carlos Panato --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4ad40e4..a00fe44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,10 @@ **Other changes** +- The webhook handler verifies the `X-Hub-Signature-256` signature (falling back to the legacy SHA-1 `X-Hub-Signature` only when it is absent), compares it in constant time and rejects malformed signature headers instead of panicking (#300). It no longer logs the expected signature on a mismatch, and bodies over 25 MB (GitHub's maximum) are rejected with `413`. +- Fix the ping event handling and stop the billing pollers on shutdown (#300). - Build with Go 1.27.2 and update dependencies (`prometheus/client_golang` 1.25, `prometheus/common` 0.72, `go-github` v92). +- Refresh the README: metrics and flags reference, webhook events, Docker image and example queries (#298, #299). ## 0.3.0 / 2022-04-20