v2.5.1

Notable changes

The /redirect-to endpoint will now validate the domain of the given destination URL against an allowlist if configured with the -allowed-redirect-domains CLI argument or ALLOW_REDIRECT_DOMAINS env var. This allows operators of public go-httpbin instances like httpbingo.org to eliminate an open redirect, as highlighted in this security advisory.

What's Changed

• Enable CodeQL security scanning by @mccutchen in #96
• Allow restricting redirect destinations by @mccutchen in #97

Full Changelog: v2.5.0...v2.5.1