Skip to content

v2.0.0

Latest
Latest

Choose a tag to compare

View all tags
@SeaweedbrainCY SeaweedbrainCY released this 01 Jul 23:08
v2.0.0
This tag was signed with the committer’s verified signature.
SeaweedbrainCY Nathan
GPG key ID: BAF0003B9DE496BF
Verified
Learn about vigilant mode.
ab68bbb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Full Changelog: v2.0.0...v2.0.0

Important

This version brings security patch. Upgrade is highly recommended.

🐳 New Docker images

Update available upon the following tags : 2.0, 2.0.0 and latest.
Recommended tag :

  • API : ghcr.io/seaweedbraincy/zero-totp-api:2.0
  • Frontend : ghcr.io/seaweedbraincy/zero-totp-frontend:2.0

Exact tag :

  • API : ghcr.io/seaweedbraincy/zero-totp-api:2.0.0
  • Frontend : ghcr.io/seaweedbraincy/zero-totp-frontend:2.0.0

Latest tag:

  • API : ghcr.io/seaweedbraincy/zero-totp-api:latest
  • Frontend : ghcr.io/seaweedbraincy/zero-totp-frontend:latest

Breaking change

  • The account deletion endpoint was switched from DELETE to POST. Frontend/API Client version should adapt accordingly. No action beside update required.

Features

  • Add the support of capacitor for iOS application building. The iOS application is not yet disclosed to the public but this version brings most of the iOS work.
  • Add a loading screen to improve navigation
  • Bring a whole new design for mobiles
  • Add a new capacitor plugin to safely handle secret storing in vault (with biometrics protection)
  • CSP hardening.
  • Add support of bearer authentication that can be used instead of cookie

Fix

  • Fixed src_ip propagation for rate-limiting, fixed a bug injecting the wrong object instead of tokens, and made request bodies nullable where appropriate (e.g. /auth/refresh no longer requires a body for web clients).
  • Introduced a proper context-passing mechanism through Connexion so controllers consistently receive src_ip, user_obj, and token_info as kwargs instead of ad-hoc parameter names (ip, user_id, etc.), fixing several inconsistent/incorrect argument injections.
  • Hardened CICD dependencies

Chore

  • Bump fast-uri from 3.1.0 to 3.1.2 in /frontend
  • Bump ip-address and express-rate-limit in /frontend
  • bump cryptography from 46.0.6 to 46.0.7 in /api
  • Bumps python-multipart from 0.0.27 to 0.0.31.
  • Bump starlette from 0.49.1 to 1.3.1 in /api
  • Bump hono from 4.12.21 to 4.12.27 in /frontend
  • Bump tmp from 0.2.5 to 0.2.7 in /frontend
  • Bump tmp from 0.2.5 to 0.2.7 in /mobile
  • Bump idna from 3.10 to 3.15 in /api
  • Bump follow-redirects from 1.15.11 to 1.16.0 in /frontend
  • Bump python-dotenv from 1.1.0 to 1.2.2 in /api
  • Bump aiohttp from 3.13.4 to 3.14.1 in /api
Assets 2
Loading