You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
3D Scene block: a new block type for the canvas, supporting primitives, models, and hotspots (#128).
OIDC authentication fully configurable through environment variables (OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET): if all three are set at startup, the OIDC provider is enabled and the management UI card turns gray with a "Set by environment variables" badge (#136).
Fixed
Fixed MCP tools returning no projects when PostgreSQL runs under a non-superuser role with row-level security enabled; MCP requests now run inside withAuthenticatedSession and use getDb() so RLS evaluates against the API key's user (#141).
Fixed OIDC sign-in failing with invalid_state when the identity provider requires the state parameter, such as Pocket ID 2.10+; Auth.js now sends and validates state alongside PKCE on the authorization request and callback (#142).
Security
The Docker image now runs on Node 24.22.2, which includes the fix for CVE-2026-111497 (remote code execution via Brotli decoding) along with V8 stability and performance backports, and the base image is pinned to that exact version so future builds no longer drift (#140).