v0.14.1

A patch release for 0.14.0. It fixes opening the portal from the widget for returning visitors, Microsoft sign-in with a Tenant ID, "Load more" on the public changelog and unsubscribe links opened by email scanners. It also gives identity providers a clearer Profile and Roles setup, lets you add people who already sign in as teammates, and patches three dependency advisories.

Upgrade the same way as any patch: pull the new image and restart.

Upgrading

• One new database migration - Adds a table that records the name and avatar each identity provider last wrote. It runs automatically on start and changes no existing data.
• New optional setting - EMAIL_SES_MAX_SEND_RATE caps Amazon SES sends per second for each Quackback process (default 10). If several processes share one SES account, set it to roughly the account's per-second quota divided by the number of processes.

Security

• Dependency advisories patched - Updated proxy-addr (IP spoofing through an IPv4-mapped IPv6 trusted subnet), source-map-js (denial of service) and the MCP TypeScript SDK (OAuth credentials could be sent to an authorization server chosen by the MCP server).
• Require SSO covers email sign-in links - The portal's email sign-in now refuses an address at a verified domain that requires SSO, like every other sign-in method.
• Email changes always confirm the current address - Changing an email goes through the flow that proves the current address first, and accounts at a domain that requires SSO keep the address their provider gave them.
• Admin-entered emails are not marked verified - Editing a person's email in People clears its verified flag unless the address is unchanged.

Improvements

• Profile card for identity providers - A provider's page always shows what Quackback takes from it for each person (account ID, email, name, username and avatar), next to the values from the last test sign-in.
• Avatar and username claims - Choose which claim holds a person's avatar or username when your provider doesn't send the standard ones, with a preview of the picture before you apply it.
• Keep names and avatars in step with the provider - An optional per-provider setting updates name and avatar on every sign-in, and never overwrites a name or picture someone changed in Quackback.
• One Roles card - Role rules, the default role and when roles are applied now live in one card on the provider's page. Rules can give custom roles, and a guard blocks a change that would remove admin access from the provider's own admins.
• Add people who already sign in - One Add people dialog finds people who have signed in and makes them teammates right away, or invites new addresses by email. Only admins can grant the Admin role.
• One-click unsubscribe - Notification emails carry unsubscribe headers so mail clients can offer one-click unsubscribe. Opening an unsubscribe link now asks for confirmation, so link scanners can no longer unsubscribe people.
• Paced Amazon SES sending - Large announcements go out at a steady rate instead of running into SES throttling.

Fixes

• Opening the portal from the widget works for returning visitors - Visitors whose browser already had a cookie on the portal saw "Sign-in link expired" instead of being signed in, which affected almost everyone after their first visit. (#642)
• Microsoft sign-in uses your Tenant ID again - In 0.14.0 the Tenant ID you configured for Microsoft sign-in was ignored and every sign-in used the "common" endpoint, so single-tenant app registrations could not sign in and sign-in was not limited to your directory. The setting is labelled "Tenant ID" again, and values saved in 0.14.0 are picked up automatically.
• Default role shown correctly - A provider with no saved default role now shows Member, which is what sign-in gives people at a verified domain.
• Changelog "Load more" works - Loading more entries on the public changelog failed in the portal and widget once a workspace had more than one page of entries.
• Changelog feed paths - /changelog/rss and /changelog/rss.xml redirect to the feed, and a malformed entry link shows not found instead of an error.
• Webhook dialogs scroll - The create and edit webhook dialogs scroll on smaller screens, so the save button is always reachable. (#672)
• Magic-link hint lists every email provider - The magic-link setting now names Resend alongside SMTP and Amazon SES.
• Self-hosting guide corrected - Requirements (PostgreSQL 14+ with pgvector 0.5.0+ and pg_trgm), published image tags, migrate and start commands, the Railway deploy link, and connection pooling advice are now accurate.

Internal

• Quieter error logs - Expected failures such as invalid form input, closed connections, unconfigured integrations, email throttling that will be retried and AI work refused by the AI allowance are logged as warnings or info instead of errors.
• AI usage accounting - Embedding calls are recorded in the AI usage log without counting toward any allowance, and help center auto-translate pauses while an AI token allowance is used up.

Full Changelog: v0.14.0...v0.14.1