Skip to content

anubis 1.24.0#259965

Merged
BrewTestBot merged 2 commits intomainfrom
bump-anubis-1.24.0
Dec 24, 2025
Merged

anubis 1.24.0#259965
BrewTestBot merged 2 commits intomainfrom
bump-anubis-1.24.0

Conversation

@BrewTestBot
Copy link
Copy Markdown
Contributor

Created by brew bump


Created with brew bump-formula-pr.

Details

release notes
Anubis is back and better than ever! Lots of minor fixes with some big ones interspersed.
  • Fix panic when validating challenges after privacy-mode browsers strip headers and the follow-up request matches an ALLOW threshold.
  • Expose WEIGHT rule matches as Prometheus metrics.
  • Allow more OCI registry clients based on feedback.
  • Expose services directory in the embedded (data) filesystem.
  • Add Ukrainian locale (#1044).
  • Allow Renovate as an OCI registry client.
  • Properly handle 4in6 addresses so that IP matching works with those addresses.
  • Add support to simple Valkey/Redis cluster mode
  • Open Graph passthrough now reuses the configured target Host/SNI/TLS settings, so metadata fetches succeed when the upstream certificate differs from the public domain. (1283)
  • Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.
  • Refine the check that ensures the presence of the Accept header to avoid breaking docker clients.
  • Removed rules intended to reward actual browsers due to abuse in the wild.

Dataset poisoning

Anubis has the ability to engage in dataset poisoning attacks using the dataset poisoning subsystem. This allows every Anubis instance to be a honeypot to attract and flag abusive scrapers so that no administrator action is required to ban them.

There is much more information about this feature in the dataset poisoning subsystem documentation. Administrators that are interested in learning how this feature works should consult that documentation.

Deprecate report_as in challenge configuration

Previously Anubis let you lie to users about the difficulty of a challenge to interfere with operators of malicious scrapers as a psychological attack:

bots:
  # Punish any bot with "bot" in the user-agent string
  # This is known to have a high false-positive rate, use at your own risk
  - name: generic-bot-catchall
    user_agent_regex: (?i:bot|crawler)
    action: CHALLENGE
    challenge:
      difficulty: 16 # impossible
      report_as: 4 # lie to the operator
      algorithm: slow # intentionally waste CPU cycles and time

This has turned out to be a bad idea because it has caused massive user experience problems and has been removed. If you are using this setting, you will get a warning in your logs like this:

{
  "time": "2025-11-25T23:10:31.092201549-05:00",
  "level": "WARN",
  "source": {
    "function": "github.com/TecharoHQ/anubis/lib/policy.ParseConfig",
    "file": "/home/xe/code/TecharoHQ/anubis/lib/policy/policy.go",
    "line": 201
  },
  "msg": "use of deprecated report_as setting detected, please remove this from your policy file when possible",
  "at": "config-validate",
  "name": "mild-suspicion"
}

To remove this warning, remove this setting from your policy file.

Logging customization

Anubis now supports the ability to log to multiple backends ("sinks"). This allows you to have Anubis log to a file instead of just logging to standard out. You can also customize the logging level in the policy file:

logging:
  level: "warn" # much less verbose logging
  sink: file # log to a file
  parameters:
    file: "./var/anubis.log"
    maxBackups: 3 # keep at least 3 old copies
    maxBytes: 67108864 # each file can have up to 64 Mi of logs
    maxAge: 7 # rotate files out every n days
    oldFileTimeFormat: 2006-01-02T15-04-05 # RFC 3339-ish
    compress: true # gzip-compress old log files
    useLocalTime: false # timezone for rotated files is UTC

Additionally, information about how Anubis uses each logging level has been added to the documentation.

DNS Features

  • CEL expressions for:
    • FCrDNS checks
    • Forward DNS queries
    • Reverse DNS queries
    • arpaReverseIP to transform IPv4/6 addresses into ARPA reverse IP notation.
    • regexSafe to escape regex special characters (useful for including remoteAddress or headers in regular expressions).
  • DNS cache and other optimizations to minimize unnecessary DNS queries.

The DNS cache TTL can be changed in the bots config like this:

dns_ttl:
  forward: 600
  reverse: 600

The default value for both forward and reverse queries is 300 seconds.

The verifyFCrDNS CEL function has two overloads:

  • (addr)
    Simply verifies that the remote side has PTR records pointing to the target address.
  • (addr, ptrPattern)
    Verifies that the remote side refers to a specific domain and that this domain points to the target IP.

What's Changed

New Contributors

Full Changelog: TecharoHQ/anubis@v1.23.1...v1.24.0

View the full release notes at https://github.com/TecharoHQ/anubis/releases/tag/v1.24.0.


@github-actions github-actions bot added go Go use is a significant feature of the PR or issue nodejs Node or npm use is a significant feature of the PR or issue bump-formula-pr PR was created using `brew bump-formula-pr` labels Dec 24, 2025
@github-actions
Copy link
Copy Markdown
Contributor

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.

@github-actions github-actions bot added the CI-published-bottle-commits The commits for the built bottles have been pushed to the PR branch. label Dec 24, 2025
@BrewTestBot BrewTestBot added this pull request to the merge queue Dec 24, 2025
Merged via the queue into main with commit 56581d4 Dec 24, 2025
22 checks passed
@BrewTestBot BrewTestBot deleted the bump-anubis-1.24.0 branch December 24, 2025 05:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bump-formula-pr PR was created using `brew bump-formula-pr` CI-published-bottle-commits The commits for the built bottles have been pushed to the PR branch. go Go use is a significant feature of the PR or issue nodejs Node or npm use is a significant feature of the PR or issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants