Skip to content

v1.2.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 11:06
· 69 commits to main since this release
v1.2.7
94855a3

First release under maintenance mode. ViTransfer now ships security patches weekly and no new features — see the announcement for what that means if you self-host.

This one also carries an admin UI change that was already in flight.

Changed

  • The admin top menu bar is now a left sidebar. On desktop it collapses between a labelled 240px panel and a 64px icon rail, and it remembers your choice. On phones and narrow windows it becomes a drawer behind a hamburger, so the page keeps its full width.
  • The brand logo sits at the top of the sidebar; theme, about and the user menu moved to the footer.
  • Wide custom logos no longer overflow. If you upload a wide logo it scales to fit instead of stretching or spilling out of the rail.

Security

  • dompurify 3.4.12 -> 3.4.13 via isomorphic-dompurify (IN_PLACE hook XSS)
  • undici 7.28.0 -> 7.29.0 via jsdom (cache directive disclosure, CRLF injection, cookie attribute injection, response desync)
  • brace-expansion pinned to 5.0.9 in overrides (expansion DoS)
  • js-yaml 4.3.1 and nanoid 3.3.18
  • GitHub Actions pinned to commit SHAs
  • CodeQL now scans python and actions alongside javascript-typescript

Dependencies

  • @aws-sdk/s3-request-presigner 3.1079.0 -> 3.1106.0
  • driver.js 1.6.0 -> 1.8.0
  • tsx 4.22.5 -> 4.23.11
  • eslint-config-next 16.2.12 -> 16.3.0
  • npm patch group (15 updates)

npm audit reports 0 vulnerabilities as of this release.

Under the hood

Releases are now built and published by CI rather than from my laptop. Every dependency update runs 19 clean-install and 22 upgrade tests against real Postgres and Redis containers before it can merge, and the whole suite runs again against the exact tree being shipped before any image is published. Major version bumps are never taken automatically.

Upgrade

docker compose pull && docker compose up -d

Images are published for linux/amd64 and linux/arm64 as both mansivisuals/vitransfer:1.2.7 and :latest.

Assets 2
Loading