Repository navigation
Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 3 commits
- 13 files changed
- 1 contributor
Commits on Oct 29, 2026
-
docs: state v4 bug-fix and security-fix dates (#3194)
v4 receives bug fixes until 2026-12-31 and free security fixes until 2027-12-31 on its latest release; the full policy lives in SECURITY.md on master.
Commits on Oct 30, 2026
-
fix: secure v4 client IP defaults for proxying and rate limiting (#3197)
* fix: derive v4 client IP from the connection peer by default Ignore untrusted forwarding headers when IPExtractor is unset and always replace upstream X-Real-IP from Context.RealIP. Preserve explicit extractors and document migration for applications behind proxies. Addresses CVE-2026-118651 and CVE-2026-118653. * fix: preserve derived proxy identity after hop header stripping * docs: describe the secure RealIP default on the public interface
-
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v4.16.2...v4.16.3