fix(security): 1.35.6 hardening stack (14-vector audit remediation)#85

Open

andypost wants to merge 14 commits into

freeunitorg:pre-1.35.6from

andypost:hardening-1.35.6

Commits on Jul 6, 2026

fix(tls): validate cert/key pair and guard wildcard SAN matcher

andypost
and
claude
committed
fix(routing): correct CIDR, regex, and port-range matcher edges

andypost
and
claude
committed
fix(fd): tighten FD/CLOEXEC lifetime across accept/pipe/compression

andypost
and
claude
committed
fix(websocket): tighten frame-bound checks in libunit and protocol

andypost
and
claude
committed
fix(port): bounds-check untrusted shmem offsets in port and libunit

andypost
and
claude
committed
fix(sapi): bounds-check app-supplied arguments in language bindings

andypost
and
claude
committed
fix(isolation): tighten control-socket, mount, and cgroup boundaries

andypost
and
claude
committed
fix(controller): cap JSON parser limits and harden request state

andypost
and
claude
committed
fix(http): bound proxy Content-Length and URI/string helpers

andypost
and
claude
committed
docs(changes): record 1.35.6 hardening fixes

andypost
and
claude
committed
fix(unit): guard sptr bounds check against tiny buffers

andypost
and
claude
committed
fix(isolation): require path separator after rootfs prefix

andypost
and
claude
committed
fix(fd): fall back to pipe() when pipe2() returns ENOSYS

andypost
and
claude
committed
fix: address pre-merge review findings in bindings and websocket paths
andypost
committed