v0.20.0

0.20.0 (2026-09-16)

Features

• auth,sdk: add refresh token support end-to-end (9a474ae)
• auth: add a password-grant token endpoint for non-browser clients (8777993)
• bakend: add auth other backend only (d355acf)
• client: add GitHub and API docs links to the footer (c84e780)
• client: display tasks as a tile grid instead of a table (ec15ade)
• gpu available (7effe35)
• sdk: add a TypeScript/Node.js SDK (sdk/js) (c3b5db2)
• sdk: sync client routes/schemas with the API, add login() (56b9d29)

Bug Fixes

• auth: add API_KEYS for machine-to-machine authentication (96e9c4e)
• auth: end the Keycloak SSO session on logout (b4f16a2)
• auth: rate-limit /api/auth/login per client IP (0905ab9)
• auth: reject cross-site logout requests as CSRF defense in depth (0d3bf39)
• auth: remove the VITE_SSO_BYPASS frontend auth-guard bypass (ae03b43)
• auth: route login through keycloak-js and pin the redirect_uri (9ce9d3e)
• auth: stop trusting empty-subject/introspection claims and freeze roles (ac1f26d)
• auth: strip OIDC response params before Keycloak check-sso (fed37aa)
• auth: strip trailing slash from BACKEND_PUBLIC_URL too (0d3cf18)
• ci: tag Harbor images with the chart appVersion (1b51ed5)
• client: correct pagination cursor and default bounding boxes display (55c8d3c)
• client: install from the committed lockfile in the Docker image (c69e3c0)
• client: install libatomic1 for pnpm's native binary in the slim image (1142d8e)
• client: keep the tasks tab up to date, add a manual refresh button (f048142)
• delete commitizen (3d9fdb6)
• deps: bump aiohttp, h2, tornado and transformers (darwin) to patched versions (06cbb4e)
• deps: pin transitive npm packages to patched versions via pnpm overrides (bff9a87)
• frontend: handle nullable percentage in the task sort comparator (27c3db6)
• frontend: paginate the user tasks list correctly (ef3737b)
• gitleak disbale false postif (626bd6f)
• linting helm (9d1aac4)
• non root user into container (8fb66d5)
• refresh gitleaksignore fingerprint after history rewrite (773e764)
• release: bump pyproject.toml/package.json on prerelease too (ff85715)
• security: apt upgrade the api image's base packages (#469) (a1f7fc7)
• security: apt upgrade the worker image's base packages (#469) (4c9ce58)
• security: make the images usable under an arbitrary UID (f9e2807)
• security: stop leaking secrets into the keycloak container and drop an unread test env var (2daf830)
• sync gitleaksignore fingerprints onto this branch (f297d13)
• version: correct path to pyproject.toml for version detection (07f1122)
• worker: stop dropping pages 2+ of multi-page DOCX/PPTX/etc results (d8ce56a)

Performance Improvements

• client: short-circuit the auth guard on an already-confirmed session (6c9c5b4)
• client: stop copying node_modules into the docker build context (627c743)
• update with latest package (ba49a8f)

Code Refactoring

• frontend: tighten task list types, drop any (7ee64d9)
• sdk: move the Python SDK into sdk/python (7cb0bd8)

Dependencies

• deps: bump Node to 24 LTS and upgrade the JS dependencies (b76539a)
• deps: migrate to pnpm 11 and refresh the container base images (f8ab00c)