Release notes from secured-signal-api

v1.6.0 RC1

2026-03-06T17:24:42Z

Hello and welcome 😎,
This is release candidate 1 of v1.6.0

Note

To test out this release candidate use ghcr.io/codeshelldev/secured-signal-api:v1.6.0-rc1

Warning

This is a pre-release, this means that it may contain bugs and unstable or broken features and
is therefor not meant for production use and solely for testing purposes

What's Changed

So..., what does this new update bring us?

Let me give you a quick overview:

fixed some config settings not being normalized (lowercased)
added Scheduled Messages on /v2/send with send_at as timestamp
added config settings to disable Templating and URL-To-Body Injection for various mediums (path, query, body, etc.)
added templating to configs with ${{ .env.XYZ }} or ${{ .vars.NUMBER }} (see Configuration)
overhauled matching system with multiple match types (see docs for: Endpoints, Field Policies, IP Filter):
- exact
- equals: case-incensitive
- prefix
- suffix
- contains: string contains
- regex
- glob: glob-style patterns
- has: dict has key
- includes: array includes item

🚨 Breaking Changes

settings.message.template is now located under settings.message.templating.messageTemplate
settings.access.ipFilter, settings.access.endpoints are now separated into allowed and blocked:
```
ipFilter:
   allowed:
       - 1.2.3.4
   blocked:
       - 5.6.7.8
```

settings.access.endpoints now use the new, more flexible matching system:

endpoints:
   allowed:
      - pattern: "/v1/receive[0-9]+"
        matchType: regex
      - pattern: "/v1/about"

Docs

[*] API documentation
[*] Update in Home Assistant integration guide, now support for ANY version

PRs

fix: Overwrites not Applying by @CodeShellDev in #239
feat: Scheduled Messages by @CodeShellDev in #243
Automated README update by @github-actions[bot] in #256
feat: Improved Regex handling and Custom type compilers by @CodeShellDev in #268
feat: Improved Placeholders in Configs by @CodeShellDev in #278

Full Changelog: v1.5.1...v1.6.0-rc1

Cya 🐢

v1.5.1 Misc

2026-01-31T18:31:36Z

Well hello, long time no see 📣
Back again, this time with a small misc update, just some things that I thought could be improved.

What's Changed

Message Templates are no longer applied on every request and instead are only triggered on /v2/send with method=POST,
this only affects templates rendering with settings.message.template

/v1/about now includes...

{
    "versions": ["v1", "v2"], 
    "build": 2, 
    "mode": "normal", 
    "version": "0.97", 
    "capabilities": { "v2/send": ["quotes", "mentions"] },
    "secured-signal-api": {
       "version": "1.5.1",
       "auth_required": true
    }
}

auth_required field is set depending on wether any API tokens were set.
version is gathered from a built-time env variable (IMAGE_TAG), it is stripped of any leading v,
but may include additional -rc1

Full Changelog: v1.5.0...v1.5.1

As always,
CodeShell out👋

v1.5.0

2026-01-31T13:52:41Z

Hello, hello 📣
Today is the 31st of January and with that my due date for v1.5.0 has finally hit 🎉.
So without further talking: Welcome to v1.5.0, let me show you around... 🌍️

What's Changed

A ton of new cool features 😎 have been added:

new auth methods: Path and Body Auth
separate port per Token Config (isolated realms, see docs)
separate log level per Token Config (see docs)
Ratelimiting: Prevent spam or DOS on the API (see docs)
IP filters: Block and allow IPs and CIDR ranges (see docs)
restrict access by hostname (isolated realms, see docs)
regex in Field Policies and endpoints
enable and disable auth methods (see docs)
URL-to-Body Injection: inject params into the request body using Query and Path (see docs)

Doesn't seem like much, but a lot of backend changes were needed

Documentation

[v1.5.0] Integration: Home Assistant
[*] Reverse Proxy: Apache

🚨 Breaking Changes

/.../?@authorization=API_TOKEN => /.../?@auth=API_TOKEN
Path and Query auth are disabled by default, enable them in api.auth.methods
settings.access.endpoints no longer support glob-style patterns, use regex instead
Field Policies are now arrays, update your configs to change them to arrays

🚧 Deprecation

token and tokens at root of Token Configs are now deprecated, use api.tokens instead
auth.token and api.token will be removed in favor of auth.tokens and api.tokens
overrides at the root of Token Configs are deprecated, use settings instead

PRs

Automated README updates by @github-actions[bot] in #159, #161, #164
feat: Path Auth by @CodeShellDev in #170
feat: Body auth by @CodeShellDev in #172
feat: Port per Token Config by @CodeShellDev in #174
feat: Log Level per Token by @CodeShellDev in #176
feat: Rate Limiting by @CodeShellDev in #178
DEPRECATION: @authorization => @auth by @CodeShellDev in #184
feat: IP Filtering by @CodeShellDev in #181
misc: Santa is Dead by @CodeShellDev in #186
DEPRECATION: .token, .tokens, .overrides by @CodeShellDev in #187
feat: Hostnames by @CodeShellDev in #188
feat: Regex in Field Policies by @CodeShellDev in #193
chore: Improved Logger Performance by @CodeShellDev in #204
chore: Prevent Caching by @CodeShellDev in #205
feat: Select allowed Auth Methods by @CodeShellDev in #207
feat: Regex in Endpoints by @CodeShellDev in #209
feat: Regex in Endpoints (#2) by @CodeShellDev in #212
feat: improve trusted proxy by @CodeShellDev in #223

Full Changelog: v1.4.4...v1.5.0

CodeShell out 👋

v1.5.0 RC5 – Quick Test before Release

2026-01-31T11:25:06Z

Hey ho,
quick release candidate number 5.

Note

We are so close to releasing it for real, so I don't know why you'd want to test this rc out,
but here ya go: secured-signal-api:v1.5.0-rc5

PRs

feat: URL to Body Injection by @CodeShellDev in #224

Full Changelog: v1.5.0-rc4...v1.5.0-rc5

CSD out :)

v1.5.0 RC4

2026-01-30T21:36:10Z

Heyo! 📣
4th release candidate is here, with a small bugfix...

Note

Use this rc by setting image: ghcr.io/codeshelldev/secured-signal-api:v1.5.0-rc4

What's Changed

1.2.3.4/24 is no longer converted into 1.2.3.4/32, it is expected that the user meant to use 1.2.3.0/24 instead of a single IP

PR's

feat: improve trusted proxy by @CodeShellDev in #223

Full Changelog: v1.5.0-rc3...v1.5.0-rc4

CSD out👋

v1.5.0 RC3

2026-01-30T18:25:27Z

Yyyellow everyone,
I've go another quick release candidate for ya: v1.5.0-rc3.

What's Changed

fixed unnecessary creation of sublogger for config.yml
fixed port middleware stopping middleware chain due to not serving next middleware,
when all checks pass
includes bugfix from v1.4.5

Full Changelog: v1.5.0-rc2...v1.5.0-rc3

CodeShell out👋

v1.5.0 RC2

2026-01-30T16:28:22Z

Hey there, just a small bugfix with minor improvements...

Note

Use ghcr.io/codeshelldev/secured-signal-api:v1.5.0-rc2 to test out the 2nd release candidate of v1.5.0

What's Changed

added deprecation messages for @authorization
switched to using basic colors
fixed the /auth=TOKEN/ not being stripped
bumped go to v1.25.6
updated deps
Authorization header will now be stripped before passing to downstream api
fixed default auth methods being ignored

Full Changelog: v1.5.0-rc1...v1.5.0-rc2

CodeShell out 👋

v1.4.5 Bugfix

2026-01-30T17:41:22Z

Hello everyone 📣,
this is a small but IMPORTANT bugfix.

What's Changed

fixed a major bug in token parsing

Full Changelog: v1.4.4...v1.4.5

CodeShell out 👋

v1.5.0 RC1 – Testing is Open

2026-01-30T13:27:59Z

Hey there folks 📣

As 31.01 is approaching we have released a sneak-peek in form of a release candidate v1.5.0-rc1.

Note

To test out this new release candidate you need to use ghcr.io/codeshelldev/secured-signal-api:v1.5.0-rc1 as the image

Important

Found a bug? Oops... please open up an issue to let me know! Thanks ❤️

What's Changed

A ton of new cool features have been added:

new auth methods: Path and Body Auth
separate port per Token Config (See docs)
separate log level per Token Config (See docs)
Ratelimiting: Prevent spam or DOS on the API (See docs)
IP filters: Block and allow IPs and CIDR ranges (See docs)
restrict access by hostname (See docs)
regex in Field Policies and endpoints
enable and disable auth methods (See docs)

Documentation

[v1.5.0] Integration: Home Assistant
[*] Reverse Proxy: Apache

🚨 Breaking Changes

/.../?@authorization=API_TOKEN => /.../?@auth=API_TOKEN
Path and Query auth are disabled by default, enable them in api.auth.methods
settings.access.endpoints no longer support glob-style patterns, use regex instead

🚧 Deprecation

token and tokens at root of Token Configs are now deprecated, use api.tokens instead
auth.token and api.token will be removed in favor of auth.tokens and api.tokens
overrides at the root of Token Configs are deprecated, use settings instead

PRs

Automated README update by @github-actions[bot] in #159
Automated README update by @github-actions[bot] in #161
Automated README update by @github-actions[bot] in #164
Automated README update by @github-actions[bot] in #165
Automated README update by @github-actions[bot] in #166
Automated README update by @github-actions[bot] in #167
Automated README update by @github-actions[bot] in #168
feat: Path Auth by @CodeShellDev in #170
feat: Body auth by @CodeShellDev in #172
feat: Port per Token Config by @CodeShellDev in #174
feat: Log Level per Token by @CodeShellDev in #176
feat: Rate Limiting by @CodeShellDev in #178
DEPRECATION: @authorization => @auth by @CodeShellDev in #184
feat: IP Filtering by @CodeShellDev in #181
misc: Santa is Dead by @CodeShellDev in #186
DEPRECATION: .token, .tokens, .overrides by @CodeShellDev in #187
feat: Hostnames by @CodeShellDev in #188
feat: Regex in Field Policies by @CodeShellDev in #193
chore: Improved Logger Performance by @CodeShellDev in #204
chore: Prevent Caching by @CodeShellDev in #205
feat: Select allowed Auth Methods by @CodeShellDev in #207
feat: Regex in Endpoints by @CodeShellDev in #209
feat: Regex in Endpoints (#2) by @CodeShellDev in #212

Full Changelog: v1.4.4...v1.5.0-rc1

CodeShell out 👋

v1.4.4 Bugfix

2026-01-08T21:47:08Z

Hey ho! 📣
Back again, with a small bugfix, that somehow flew under my radar 🤔...

What's Changed

Fixed #192:

Modified request bodies could not be read after successful writes occured and no Content-Type header was present.
This is due to GetReqBody() relying on Content-Type, to determine wether json or form.

So when using Query-to-Body Injection there would often not be a Content-Type header set, this meant that even tho the query was injected, the next time the body would be read, it would result in a seemingly empty Body struct.

PRs

fix: Query-to-Body Injection without Content-Type by @CodeShellDev in #192
Update copyright year in LICENSE file by @CodeShellDev in #154

Full Changelog: v1.4.3...v1.4.4

This is the 2nd release of v1.4.4 since I had forgotten to update the © notice for the LICENSE

CSD out 👋