v0.5.1

Security patch for CoPilot-PerUser. Upgrade both service images and recreate the running containers to apply the fixes.

Security fixes

• Node.js 26.12.1 fixes Node2Shell (CVE-2026-111497) and the other October Node.js security advisories. The previous v0.5.0 web image used affected Node.js 26.11.1.
• Next.js 16.4.1 fixes the Server Actions denial of service (CVE-2026-94482) affecting the sign-in and sign-out forms, and includes the upstream fixes for the related critical image-optimization and cache advisories.
• Go 1.27.3 fixes the compromised-certificate-authority issue (CVE-2026-111943) and earlier standard-library advisories present in the previous Go 1.26.8 build. Host builds also require the patched compiler.
• Updated the affected development-only Undici and Zod dependencies while preserving the existing braces mitigation.
• CI and release jobs now use the pinned patched Node runtime. Host install, development, build, and start commands reject unsupported Node versions.

Upgrade

• Web image: ghcr.io/annonator/copilot-peruser-web:v0.5.1
• API image: ghcr.io/annonator/copilot-peruser-api:v0.5.1
• Host development: Node.js 26.12.1 and Go 1.27.3. Patched Node 22.23.4+ and 24.22.1+ remain supported within their release lines.

Publishing this release does not automatically restart existing deployments. Pull and redeploy both images, or rebuild both services from this tag.

Validation

Frontend lint, typecheck, tests, production build, Go vet/race tests, Docker builds, and fixture/auth-boundary smoke checks pass. Full and production npm audits, govulncheck, and Trivy scans of both locally built runtime images report no vulnerabilities. The Node2Shell regression checks malformed Brotli data in synchronous and streamed forms while preserving valid native-fetch responses.

Patch: #42

Sources: Node.js October security release, Next.js Server Actions advisory, Go certificate-validation update.

v0.5.0

What's Changed

• Fix dependency security vulnerabilities by @Annonator in #41
• chore(deps): refresh Vitest and Next.js dependencies by @dependabot[bot] in #37

Full Changelog: v0.4.3...v0.5.0

v0.4.3

What's Changed

• chore(deps): bump next from 16.2.9 to 16.3.0 in /src/web by @dependabot[bot] in #22
• chore(deps-dev): bump brace-expansion from 1.1.15 to 1.1.18 in /src/web by @dependabot[bot] in #21
• chore(deps): bump undici from 7.28.0 to 7.29.0 in /src/web by @dependabot[bot] in #23
• chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /src/web by @dependabot[bot] in #24
• chore(deps): bump next-auth from 5.0.0-beta.31 to 5.0.0-beta.32 in /src/web by @dependabot[bot] in #19

New Contributors

• @dependabot[bot] made their first contribution in #22

Full Changelog: v0.4.2...v0.4.3

v0.4.2

What's Changed

• Fix budget resolution fallback and usage display by @Annonator in #18

Full Changelog: v0.4.1...v0.4.2

v0.4.1

What's Changed

• Fix budget display by @Annonator in #17

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's Changed

• Fix usage dashboard period handling and add budget charting by @Annonator in #16

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• Refresh the usage dashboard UI with a new visual system by @Annonator in #15

Full Changelog: v0.2.2...v0.3.0

v0.2.2

What's Changed

• [codex] fix daily usage data by @Annonator in #14

Full Changelog: v0.2.1...v0.2.2

v0.2.1

What's Changed

• Expand SAML identity lookup beyond members-only filter by @Annonator in #13

Full Changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• Add optional Cloud Run IAM auth for the API by @Annonator in #9
• Update web app dependencies and Docker build setup by @Annonator in #10
• [codex] fix usage cache coalescing race by @Annonator in #12

Full Changelog: v0.1.0...v0.2.0