Postwright Release Note: One Fix at a Time

The last time I ran a batch of security fixes on one of my own tools all at once, it broke things, and I didn't find out until later. So when a security scan of Postwright 0.3.0 came back with 46 findings in the libraries it's built on, I upgraded them one at a time. Each one had to pass the full test suite, a build of the real installer, and a walk through every page of the app before the next one started. It took a Sunday morning, and every problem it turned up was caught before it shipped.

That process also turned up a problem in Postwright's own code rather than in a library: a specially encoded web address could get past the login check. I fixed it in 0.3.0 before it was announced and before anyone had downloaded it. Everything else is in 0.3.1, along with a handful of smaller holes I found when that bug sent me back through everything Postwright answers from the outside. This one matters more to the people running Postwright than to how I run Fieldway, but the one-change-at-a-time rule came straight from breaking my own systems.

What changed

• Web server and file serving. The libraries that handle every request and serve the dashboard are on their latest patched releases, with stricter handling of unusual web addresses.
• Safer note parsing. The parsers that read your notes' front matter now reject oversized or malformed front matter instead of bogging down.
• Same images, newer library. Image processing for hero images and social art is updated, and its output is byte-for-byte identical to before across every transform I tested.
• Smaller installer. It's about 4 MB smaller, because an unused fallback image library no longer ships with it.
• Clearer errors. A malformed request now gets a plain "bad request" error instead of a server error.
• Signup widget. It's served more strictly now, so link it with its exact file name, like /widget/postwright-signup.js.
• Fewer ways in. Postwright now answers only to its own local addresses, your tunnel, and hostnames you add in Settings, and your dashboard ignores requests that come from other websites. When it uses Claude Code for AI work, it runs with no tools and no plugins.
• Limits that don't collide. Rate limits are set per route now, so traffic hammering one part of your tunnel can't lock out the rest: new signups, unsubscribe links, or Instagram fetching your Reels.
• One-click approve works. The newsletter approve link in Telegram now opens without a login, shows you what's about to go out, and sends it exactly once.
• What's left. One library has no fixed version yet, and Postwright already blocks the part of it that was dangerous. Another only checks Postwright's own settings at startup, so nothing outside your Mac can reach it, and it's on the list to revisit.

Postwright 0.3.1 is at postwright.app.