Skip to content

v0.7.5

Choose a tag to compare

View all tags
@keysersoft keysersoft released this 14 Sep 12:05
· 37 commits to main since this release
v0.7.5
a481c74
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release focused on session revocation and role enforcement on self-hosted instances. Cloud behaviour is unchanged.

  • Revoking sessions now also covers the OAuth refresh grant. Raising a member's session watermark (deactivation, demotion, password change, or the new actions below) used to leave AI clients holding a refresh token able to mint fresh access tokens. POST /token now answers invalid_grant for a revoked refresh token, so the client re-authorizes on its own. No need to clear oauth_clients any more. (#581)
  • Members with no MCP role fail closed in workspaces that use tool whitelists. Previously a member nobody had granted a role to was treated as unrestricted. Workspaces that have never created a whitelist keep the previous behaviour; a warning in the backend log names the member and the workspace when the new rule applies. (#581)
  • Force re-authentication from the panel. Settings → Users → Sign out everywhere for one member, Settings → General → Security → Sign everyone out for the whole workspace (typed confirmation, "Also sign me out" on by default). MCP API keys are not sessions and are left alone unless you tick the option. New audit event WORKSPACE_SESSIONS_REVOKED. (#581)
  • Identity provider marks on the sign-in buttons, on both the dashboard login and the MCP authorization page. (#581)
  • Single sign-on settings: editor for the default MCP roles used by the "Grant a default role" fallback (saving is blocked when the list is empty), and a proper notice on Cloud instead of a load error. (#581)

Upgrade note for self-hosted: if you revoked sessions for members in the last 30 days, their AI clients will be asked to sign in again once after this update.

Assets 2
Loading