Skip to content

0.4.2 — security release

Choose a tag to compare

View all tags
@Mfrostbutter Mfrostbutter released this 02 Jul 21:27
· 77 commits to main since this release
v0.4.2
6998de5

Security release: upgrade recommended.

Fixes four high-severity findings from the 2026-07-01 full security review (all reachable by the read-only viewer role or by an operator escalating to host root), plus the medium/low batch.

Security

  • Agent Fleet in-process code execution is now admin-only (/api/agent-fleet → require_role("admin")).
  • MCP server management SSRF closed (/api/mcp operator-gated; every fetch through assert_safe_probe_url).
  • Docker community-template JSON injection closed (substitution only on parsed string leaves).
  • DOM XSS in the markdown renderers closed (escape-before-transform; DOMPurify on Agent Fleet).
  • Medium/Low batch resolved (inspect redaction, host-scoped secret binding, credential-mirror SSRF guard, constant-time API-key compare, TOTP replay window, encrypted template_state, and more).

Added

  • Name and port your services in the setup wizard, with live port-conflict warnings (new GET /api/containers/ports-in-use).
  • Show/hide toggle on password fields (owner setup, sign in, reset).
  • Configurable error-reporting window on the Overview (24h / 7d / 30d / 90d / All, default 30d).

Full detail in CHANGELOG.md.

Assets 2
Loading