CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

0.3.1 - 2026-07-04

Added

• URL validation before rendering: only http:// and https:// schemes allowed; file://, data:, javascript: blocked
• DNS resolution with private IP blocking: loopback, RFC1918, link-local, cloud metadata (169.254.x.x) all rejected — prevents SSRF
• Fail2ban-style IP rate limiting: 3 auth failures in 5 minutes → 10 minute ban, with X-Forwarded-For support

Changed

• Reduce max_body_size from 10 MB to 64 KB — render/screenshot payloads are small JSON
• Promote blocked-request filter log from DEBUG to INFO for production visibility

Fixed

• CRITICAL: SSRF via file:///etc/passwd — Playwright page.goto() accepted arbitrary schemes
• CRITICAL: SSRF via http://127.0.0.1:9222 — CDP debug endpoint exposed WebSocket URLs enabling RCE
• CRITICAL: No URL validation — user-supplied URLs forwarded to Playwright without sanitization
• MEDIUM: data: URLs accepted — attacker could render arbitrary HTML content

0.3.0 - 2026-06-26

Added

• Outbound request filtering using StevenBlack/hosts community blocklist (~82k ad/tracker/malware domains), blocking at the Playwright level via page.route() (#21)
• Two-tier render cache: L1 in-memory TTLCache + L2 S3-compatible persistent storage via minio client — supports Cloudflare R2, Oracle Object Storage, AWS S3, etc. (#21)
• L2 TTL enforcement via embedded _stored_at timestamp, checked on read
• S3 lifecycle rule auto-set on startup (7× TTL expiry as bulk cleanup safety net)
• make update-blocklist target to refresh blocklist from jsDelivr CDN
• New env vars: VEILRENDER_RESOURCE_FILTER, VEILRENDER_CACHE_ENABLED, VEILRENDER_CACHE_TTL, VEILRENDER_S3_ENDPOINT, etc.

0.2.0 - 2026-06-13

Added

• Stats dashboard at GET / with badges, capacity bar, and responsive layout (#20)
• Public HF Space (no auth) with live demo badge
• .dockerignore and Docker safety CI

Changed

• Bump default max_concurrent from 3 to 5
• Pre-download Chromium as runtime user to avoid re-download on startup

Fixed

• HF Space deploy: delete symlink before writing README
• Pre-commit formatting for dashboard.py

0.1.0 - 2026-06-12

Added

• Core rendering API with three endpoints:
  • POST /render — URL → rendered HTML / Markdown / readability-extracted text
  • POST /screenshot — URL → PNG screenshot
  • GET /health — liveness check
• CDP WebSocket proxy at /cdp for direct browser control (#3)
• Token-based authentication via Authorization: Bearer header or ?token= query param
• Per-request browser context isolation with configurable concurrency (VEILRENDER_MAX_CONCURRENT)
• CloakBrowser integration — stealth Chromium with 58 source-level anti-fingerprint patches (#14, #15)
• 13 vendored zerodep modules — only external dependency is cloakbrowser
• Docker image based on python:3.12-slim with multi-arch support (amd64/arm64)
• GitHub CI pipeline: pre-commit (ruff + ty), Docker build to GHCR + Docker Hub, auto-deploy to HF Spaces
• PyPI publishing on tag push
• Makefile with deploy-dev (VPS) and deploy-hf (HF Spaces) targets
• Bilingual README (en/zh)

Fixed

• CDP proxy: preserve FIN bit during WebSocket frame forwarding (#4, #12)
• HTTP multiplexer: pipe remaining POST body data instead of feed_eof() (#5, #9)
• CDP proxy: add 16 MB max frame size limit to prevent OOM (#6, #10)
• CDP proxy: cancel both directions when one side closes (#7, #11)
• CDP proxy: use random WebSocket key per connection and forward Sec-WebSocket-Protocol (#8, #13)
• Docker: use CLOAKBROWSER_CACHE_DIR so build-time binary download is available at runtime (#16, #17)
• Launch Chromium directly via subprocess.Popen + connect_over_cdp() instead of Playwright's launch(), which overrides --remote-debugging-port