From 4c0e5c6b3a99b95e41e1bd2be65443a1b4f83a45 Mon Sep 17 00:00:00 2001 From: Chris Portscheller Date: Fri, 21 Aug 2026 20:38:58 -0500 Subject: [PATCH] =?UTF-8?q?chore(release):=200.12.0=20=E2=80=94=20trusted-?= =?UTF-8?q?proxy=20client=20IP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A minor bump rather than a patch: the client IP now comes from the peer address unless the app declares how many proxies wrote the forwarding header, so an Express app behind an unconfigured proxy, or a Next.js app behind two, resolves a different address than it did in 0.11.1. Also carries the eslint config the repo never had, and two client-side corrections that fell out of it -- most notably a benchmark loop that could be optimised away, which drove mathOps toward zero and tripped the "JS execution unusually fast" automation signal on ordinary browsers. --- CHANGELOG.md | 5 ++++- package-lock.json | 16 ++++++++-------- packages/client/package.json | 2 +- packages/express/package.json | 4 ++-- packages/fastify/package.json | 4 ++-- packages/nextjs/package.json | 4 ++-- packages/webdecoy/package.json | 2 +- 7 files changed, 20 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3919789..1942d81 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.12.0] - 2026-08-22 + ### Fixed - **The client IP is no longer taken from a header the client writes.** The Express and Next.js adapters read the leftmost `X-Forwarded-For` value and treated it as the caller's address. That value is supplied by the client on the first hop, so a single `-H 'X-Forwarded-For: 1.2.3.4'` bought a fresh rate-limit bucket per forged address, put an address of the caller's choosing on every violation reported to the dashboard, and reduced `filter({ expression: 'ip.tor or ip.vpn' })` to an opt-in check. The captcha endpoints in both adapters had the same flaw. @@ -172,7 +174,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Contributing guidelines - MIT License -[Unreleased]: https://github.com/WebDecoy/node/compare/v0.11.1...HEAD +[Unreleased]: https://github.com/WebDecoy/node/compare/v0.12.0...HEAD +[0.12.0]: https://github.com/WebDecoy/node/compare/v0.11.1...v0.12.0 [0.11.1]: https://github.com/WebDecoy/node/compare/v0.11.0...v0.11.1 [0.11.0]: https://github.com/WebDecoy/node/compare/v0.10.0...v0.11.0 [0.10.0]: https://github.com/WebDecoy/node/compare/v0.9.0...v0.10.0 diff --git a/package-lock.json b/package-lock.json index 6e9a533..b615348 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10393,7 +10393,7 @@ }, "packages/client": { "name": "@webdecoy/client", - "version": "0.11.1", + "version": "0.12.0", "license": "MIT", "devDependencies": { "@types/jest": "^29.5.11", @@ -10410,10 +10410,10 @@ }, "packages/express": { "name": "@webdecoy/express", - "version": "0.11.1", + "version": "0.12.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.11.1" + "@webdecoy/node": "^0.12.0" }, "devDependencies": { "@types/express": "^4.17.21", @@ -10434,10 +10434,10 @@ }, "packages/fastify": { "name": "@webdecoy/fastify", - "version": "0.11.1", + "version": "0.12.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.11.1", + "@webdecoy/node": "^0.12.0", "fastify-plugin": "^4.5.1" }, "devDependencies": { @@ -10458,10 +10458,10 @@ }, "packages/nextjs": { "name": "@webdecoy/nextjs", - "version": "0.11.1", + "version": "0.12.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.11.1" + "@webdecoy/node": "^0.12.0" }, "devDependencies": { "@types/jest": "^29.5.11", @@ -10481,7 +10481,7 @@ }, "packages/webdecoy": { "name": "@webdecoy/node", - "version": "0.11.1", + "version": "0.12.0", "license": "MIT", "devDependencies": { "@types/jest": "^29.5.11", diff --git a/packages/client/package.json b/packages/client/package.json index b883f01..3eef193 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/client", - "version": "0.11.1", + "version": "0.12.0", "description": "Web Decoy browser widget - signal collection, proof-of-work, and captcha UI", "main": "./dist/index.js", "module": "./dist/index.mjs", diff --git a/packages/express/package.json b/packages/express/package.json index a146993..83879ae 100644 --- a/packages/express/package.json +++ b/packages/express/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/express", - "version": "0.11.1", + "version": "0.12.0", "description": "Web Decoy middleware for Express.js", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -40,7 +40,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.11.1" + "@webdecoy/node": "^0.12.0" }, "peerDependencies": { "express": "^4.18.0 || ^5.0.0" diff --git a/packages/fastify/package.json b/packages/fastify/package.json index a365f50..7cddb71 100644 --- a/packages/fastify/package.json +++ b/packages/fastify/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/fastify", - "version": "0.11.1", + "version": "0.12.0", "description": "Web Decoy plugin for Fastify", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -40,7 +40,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.11.1", + "@webdecoy/node": "^0.12.0", "fastify-plugin": "^4.5.1" }, "peerDependencies": { diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index c033b24..010c0c6 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/nextjs", - "version": "0.11.1", + "version": "0.12.0", "description": "Web Decoy middleware for Next.js", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -42,7 +42,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.11.1" + "@webdecoy/node": "^0.12.0" }, "peerDependencies": { "next": ">=13.0.0" diff --git a/packages/webdecoy/package.json b/packages/webdecoy/package.json index 33cc961..2c6a1d9 100644 --- a/packages/webdecoy/package.json +++ b/packages/webdecoy/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/node", - "version": "0.11.1", + "version": "0.12.0", "description": "Web Decoy SDK for Node.js - Bot detection with TLS fingerprinting", "main": "./dist/index.js", "types": "./dist/index.d.ts",