Skip to content

v2.7.0 — Stability & Security Hardening

Latest
Latest

Choose a tag to compare

View all tags
@Chepko932 Chepko932 released this 30 Jun 22:05
v2.7.0
0e69d0b

OctoOffice v2.7.0

Released: 2026-06-30
Type: Patch / maintenance release (security + stability + docs)

TL;DR

A stability-and-hardening cut. Closes the three Known Follow-ups that v2.6.0
deferred (#134, #135, #136), patches a ws memory-disclosure advisory, makes
database migrations transaction-safe, and refreshes the README with an animated
demo of the live office.

No breaking API changes. No migrations required.

Security

  • ws → 8.20.1 — fixes an uninitialized-memory disclosure
    (GHSA-58qx-3vcg-4xpx) reachable through the WebSocket layer.
  • Moderate prod-audit advisories cleared — pnpm audit --prod is clean again.
  • gitleaks allowlist added so secret-scanning CI no longer trips on known
    test fixtures.
  • private: true flag added to package.json to prevent accidental
    npm publish of the app package.

Fixes

  • #134 / #138 — OAuth empty-string round-trip. encryptSecret("") now
    produces a payload that decrypts back to "", closing the v2.6.0 follow-up.
  • #135 / #139 — IPv6 redirect validation. sanitizeOAuthRedirect now
    normalizes the bracketed [::1] form returned by URL.hostname, so loopback
    IPv6 redirects are accepted instead of rejected.
  • #141 / #142 — Migration transactions. Migrations now manage their own
    transaction boundary, preventing partially-applied schema changes if a single
    migration fails midway.
  • Mobile chat design aligned with the desktop composer; README logo fixed so
    it renders correctly in GitHub Mobile.

Housekeeping

  • #136 / #140 — Coverage scope. Type-only and pack-hook files are excluded
    from backend coverage so reported statement coverage reflects real code.
  • Dead code removed — unused dependencies, dead exports, and unreferenced
    internals pruned.
  • CI on Node 24 action runtimes; sharp 0.35.x pinned out pending upstream.
  • Dependency bumps — 19 + 12 + 18 minor/patch updates across three waves
    (incl. vite 7→8, undici 7→8, @vitejs/plugin-react 5→6), all green through CI.

Docs

  • Animated office demo. The README hero is now a short GIF that opens on the
    full MissionControl dashboard and tours the pixel-art office, linked to a
    full-quality MP4. A custom social-preview (OG) image was added for shared links.
  • Reusable capture tooling (scripts/capture-fullpage.mjs,
    scripts/capture-office-gif.mjs, scripts/render-tour.sh) for regenerating
    demo assets headlessly via Playwright + ffmpeg.

Upgrade Notes

No migrations required. After pulling:

pnpm install --frozen-lockfile
pnpm run setup

Existing OAuth tokens, settings rows, and pack positions continue to work without
re-encryption or schema changes.

Assets 3
Loading