0.3.3 hardens the boundaries that protect Pulse under hostile input, high load, and stalled providers. Normal dashboard behavior and successful API contracts stay the same.
What’s new
- Password changes end machine access. Changing an account password now invalidates every API token and CLI credential issued from the account’s previous credential epoch, including legacy descendant chains.
- Abusive traffic stops earlier. Account and IP login limits reserve attempts atomically. Health, readiness, onboarding, and avatar upload limits reject excess work before it can consume scarce database, network, or image-processing capacity.
- Webhooks finish cleanly. Porkbun deliveries get cheap header, size, and timestamp validation before secret access. Irrelevant events are consumed, permanent failures move to a dead letter state, and retryable configuration failures release safely.
- Private images stay owner-bound. Avatar ownership is enforced through upload, replacement, retrieval, and cleanup. Pending uploads have owner quotas, superseded blobs are removed, and authenticated image responses use private no-store caching.
- Network probes stay on public routes. RDAP follows redirects through peer validation and SSRF-safe address checks. Onboarding probes use per-user, per-target, and shared concurrency limits.
- Safer local CLI operations. Forced exports publish atomically with owner-only permissions and reject symlink destinations. File, stdin, and token readers are bounded, and resource IDs cannot inject terminal control sequences into prompts or tables.
- Monitoring keeps moving through stalls. Notification claims, database work, and provider sends have explicit deadlines. Unstarted work is released for a later retry while monitor scheduling retains time to finish.
- Shared workflows drift less. CLI pagination, monitor form adapters, and cron route behavior now each have one tested implementation shared by every caller.
- Patched dependencies. Sharp is on 0.35.3, Nano ID on 3.3.18, and PostCSS on 8.5.26. Production dependency audit reports no known vulnerabilities.
Upgrade notes
Migrations 0029_porkbun_receipt_dead_letters.sql, 0030_image_avatar_ownership.sql, and 0031_credential_epoch.sql add webhook terminal state, owner-bound avatars, and credential epochs. Existing installs apply them through the migrate-before-traffic gate. Existing avatars are claimed by their current account during migration.
After a password change, integrations authenticated with that account’s earlier API or CLI credentials must sign in again. During active abuse, login and probe limits can ask legitimate clients to retry. Authenticated images may refetch after navigation because they are no longer browser-cacheable. Unsafe referrer metadata, malformed UUIDs, oversized CLI inputs, unsafe redirects, and symlink exports now fail clearly.
Verification
- Full web lint, typecheck, 2,686 tests, and production build
- Full Go race test, vet, native build, and Windows compile checks
- Fresh PostgreSQL 16 migration through 0031 and 47 integration tests
- Credential rotation, login concurrency, image ownership, webhook retry, SSRF redirect, bounded input, and notification deadline exploit regressions
- Real Neon-backed roadmap preview migrated and tested end to end
- Production release-bound deploy proof passed