ProgrammerIn-wonderlandandClaude Opus 5.5 2f35dadb28 fix(hosting): choose the site and subdomain from Host, not X-Forwarded-Host ...

With trust proxy on, express derives req.hostname and req.subdomains from
X-Forwarded-Host, which any client can send, while host validation reads the
raw Host. A request could serve one hosted site's files on the main domain,
or reach the API on a hosting host. The header is now dropped before routing.

Fixes PUT-2272

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-02 18:32:03 -05:00

..

backend

fix(hosting): choose the site and subdomain from Host, not X-Forwarded-Host

2026-11-02 18:32:03 -05:00

cli

…

dev-center

feat(notifications): notify through KV shares, group replacement, fewer push prompts, and events/worker fixes (#4432)

2026-10-31 12:21:18 -07:00

docs

docs: complex fs recipe (PUT-1978) (#4093)

2026-11-03 03:05:34 +07:00

gui

fix: signup gate order (#4474)

2026-11-02 13:27:01 -07:00

mcp-connector

…

puter-js

chore(deps): bump postal-mime from 3.0.1 to 4.2.0 (#4461)

2026-11-02 00:05:00 -07:00

worker

docs: refresh KV sharing, Events and Notifications docs; fix router CORS and KV size error (#4445)

2026-11-01 20:27:15 -07:00

worker-types

…