Kern v0.4.0

core

Feat

• feat(mail): send every email in the recipient's language

Fix

• fix(account): make the promised 30-day undo reachable
• fix(auth): hold an MCP token to its scopes in every service
• fix(auth): hold an MCP token to the scopes it was granted
• fix(auth): let only a real session reopen a closed account
• fix(auth): resolve the client IP behind a proxy and set our own limits
• fix(auth): stop an API key acting as a session on /api/auth
• fix(env): treat a blank environment variable as unset
• fix(files): stop an uploaded file executing on the app's origin
• fix(mail): stop reporting success when nothing can send
• fix(mcp): send the workspace where every module expects it
• fix(notifications): keep one refused address from ending the digest
• fix(permissions): stop a guest reading every project in the workspace
• fix(workspaces): make the 30-day deletion undo reachable
• fix(workspaces): reserve every slug the proxy and the app own

Docs

• docs(auth): keep the session-origin comment true after the plugin change
• docs(mail): say why core does not use the module's MJML templates

Test

• test(auth): show the suite's sign-ins never reach the limiter

compare v0.3.0...v0.4.0