Forge 2.1.0

Summary

Production build for published sites, pre-rendered pages, and generation with each user's own RodiumAi token.

Changes

• Publish (#139):
  • esbuild production bundle and one minified stylesheet;
  • every route pre-rendered, with per-page SEO, sitemap.xml, robots.txt and a real 404.html;
  • published sites stay static: forms, newsletters, bookings and analytics go through the integrations catalog with the user's own ids.
• Generation (#139):
  • complete outputs, with automatic continuation of cut answers;
  • <forge-edit> SEARCH/REPLACE for existing files;
  • the brand charter (DESIGN.md) is locked after the first build.
• Per-user gateway token (#140): chat and images use the user's own RodiumAi access token. The internal lane stays as a fallback and for shared projects billed to their owner.
• Sites gateway: <page>/index.html, then 404.html with a 404 status, then the SPA shell for older publishes. Responses use zstd/gzip.
• Faster agent turns: listing project files skips node_modules and build folders. Before, this cost about 2 minutes per turn on a bind-mounted project.
• Fixes:
  • linear scans for history blocks and image sentences (#142);
  • projects still on the old @forge/forms AI rules are upgraded;
  • the draft thumbnail cache is keyed per viewer.

Deployed: forge-api:94, forge-sites-gateway:10, Amplify main job 133. PR #141.

Forge 2.0.1

Summary

Patch release after Forge 2.0.0 — Cloud generation, FRODI UI, and pricing/settings polish.

Changes

• Cloud generation without OIDC (#133): billing_uid + gateway (FRODI then RODI); BYOK only as quota fallback. No more « Reconnect RodiumAi » for linked Free accounts.
• Settings → Génération: FRODI balance + cycle meter; sync skeleton instead of plain Loading.
• Pricing (dashboard, dark): theme-aware tokens — country selector, plans, BYOK card no longer white-on-white (#134).
• Wallet badge: FREE / FRODI badge links to /settings?tab=generation (#134).
• Copy: Free FRODI usage uses month, not week (#132).
• Docs / Amplify pricing fallback / soft landing CSS restorations (#131 and follow-ups).

Deploy

• Web: Amplify main
• API: ECS forge-api (Deploy API on main)

Forge 2.0.0

Forge 2.0.0 — FRODI billing, team seats, soft marketing pricing, integrations, auth/security restorations. Shipped via PR #125 squash-merge to main (f7d12de).

Forge v1.1.0

Security

• Fix HIGH slug-rename TOCTOU (CWE-367/284): purge {old_slug}/ object prefix before freeing the slug in Postgres, so a concurrent claim+publish cannot be wiped. Credits: @BOUEHodabaloRaphael.

Integrations

• New /integrations catalog: 45 drop-in static embeds (iframe / script / link only)
• No partial kits, no Auth/BaaS SDKs, no Stripe entries
• CI contract + CONTRIBUTING docs for kit authors

Deploy

• API: ECS via Deploy API workflow on main CI success
• Web: Amplify auto-deploys apps/web

Forge v1.0.9

Auth / SSO

• Auto-mint and select Default · Forge for new Rodium users on first Forge SSO
• /auth/features gates "Continue with RodiumAi" when OIDC client is unset/placeholder
• Warm session + wallet after OIDC callback (no Connect flash)

Dashboard UI

• Keep "Prêt à créer ?" visible on all tabs
• Align Créer button with landing (pill + arrow)
• Light-mode themed prompt; dark+orange home glow only
• Lighter font weights for small UI chrome

Deploy

• API: ECS via Deploy API workflow on main CI success
• Web: Amplify auto-deploys apps/web

Forge v1.0.8

Security

• Atomic auth_tokens.consume() (conditional UPDATE) — closes reset/verify TOCTOU races
• SEO favicon path checks sandboxed via safe_resolve; reject .. traversal

Reporter credit: @KevineCharles

Forge v1.0.7

Security

Fixes account pre-hijacking via unverified email registration (GHSA-mr93-xxxp-fc3f).

On first email verification, Forge now clears the registration password and bumps token_version. Victims can set a new password from Settings or via forgot-password.

Credit: @waytogold17

Forge v1.0.6

Security

Hardens Forge against recent reports and related OIDC/S3 risks:

• Linear embed-detection scan (ReDoS)
• Publish orphan purge under {slug}/ with prefix guards
• Valkey requirepass in compose
• OIDC callback DB session pin + state nonce (SET NX)
• Custom-domain degraded-mode refuse outside local
• Reserved slugs / host-cache LRU (from prior PRs)

Notes

Includes merges from #96, #97, and #98.

Forge v1.0.5

Fixes

• Faster RodiumAi → Forge login: no longer block the OAuth callback on Nest account?fresh=1 + /me.
• Wallet badge returns cached balance immediately; Nest refresh runs in the background.
• Empty wallet cache with live OAuth tokens returns WALLET_SYNCING (retry) instead of a false INSUFFICIENT_RODI.
• Prefer JWKS-verified id_token claims over a second /userinfo round-trip.
• Parallel Nest keys + wallet hydrate after login.

Version

• Web package bumped to 1.0.5

Forge v1.0.4

Security

• Close Playwright popup SSRF by installing context-wide network interception and fulfilling requests through IP-pinned HTTP with preserved SNI.
• Require an expiring tenant-specific TXT ownership challenge before promoting custom domains or requesting ACM.
• Centralize paid RODI generation authorization and rate-limit on-demand security reviews.
• Frame vision/charter image content as untrusted third-party data.
• Validate OAuth return paths after WHATWG URL normalization.

Credits

• BOUE Hodabalo Raphaël (@BOUEHodabaloRaphael) — popup SSRF, custom-domain takeover
• Aliou Cisse (@KevineCharles) — open redirect, security-review gate, vision prompt injection