Skip to content

v0.9.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 10:49
· 196 commits to main since this release
v0.9.1
a3ed070

Security

  • Bearer token hardening: access tokens are type-gated and checked against live sessions, so refresh tokens can no longer be replayed as access credentials and revoked tokens stop working at logout
  • CSRF enforcement on cookie-authenticated dashboard mutations via a double-submit X-CSRF-Token; the dashboard's blanket exemptions were removed
  • OAuth callback CSRF protection: Google/Microsoft connect and callback now use server-side one-time state, and the workspace binding comes only from verified state metadata
  • /google/connect now requires authentication (development fallback removed)
  • OAuth login domain matching uses exact domain equality (a substring match could be bypassed by look-alike domains)
  • Sitemap XML parsing switched to defusedxml (XXE)

Changed

  • Faculty gamification and leaderboards are now opt-in and off by default
  • LMS integration maturity labeled honestly: Canvas is production-verified; others range from beta to untested
  • Documentation claims accuracy pass; SECURITY.md supported-versions table aligned; dashboard licence declared
  • Upload paths genericized and dashboard debug logging removed

Dependencies

  • bcrypt 5.0.0, redis 8.1.0, websockets 17.0.1, python-pptx 1.0.2, av 18.1.0, packaging 26.3, setuptools 84.0.0, click 8.3.3
  • Dashboard and CLI npm minor/patch groups; docker build actions updated

Upgrading

Self-hosted deployments on 0.9.0 should upgrade promptly — the security fixes above close real authentication gaps. git pull && docker compose up -d --build, or pull the 0.9.1 images from GHCR. Database migrations run automatically on container start.

Full changelog: CHANGELOG.md

Assets 2
Loading