Windlass v0.59

Automated release from dac7577: Unexport the staging API's internal types

Windlass v0.58

Automated release from 804db42: Remove private project names from the agent brief and tests

Windlass v0.57

Personal API tokens, viewer masking and a set of security fixes.

• API tokens. Create them in Settings and send them as a bearer token. Each has a scope and an optional expiry, and admins can revoke anyone's through the API. See the API guide.
• Viewers no longer see secret values. .env values and values a Compose file sets inline are masked for the viewer role.
• One instance per data directory. A second Windlass started on the same data directory now refuses to run (#43).
• Cross-origin writes are refused, and the Git token no longer appears in process arguments.
• Turning off two-factor asks for a current code.

Plugin SDK changes

Both affect plugins that use the panel's proxy.

1. The proxy no longer forwards the session cookie or the Authorization header to the plugin.
2. Anything other than GET, HEAD and OPTIONS, and any WebSocket upgrade, through the proxy now needs the member role.

Windlass v0.56

Automated release from 71393d8: Check frontend changes in change checks (#68)

Windlass v0.55

Automated release from e94bde3: Import AGENTS.md from CLAUDE.md so Claude Code loads it (#67)

Windlass v0.54

Automated release from 68aee50: Add change checks for secrets, workflows, vulnerabilities and new Go issues (#65)

Windlass v0.53

Automated release from f8fd92f: build(deps): bump the web-minor-patch group in /web with 5 updates (#64)

Windlass v0.52

Automated release from f9ba5c2: build(deps): bump the go-minor-patch group with 2 updates (#63)

Windlass v0.51

Automated release from 47af615: Bump TypeScript to 7.0.2 (#61)

Windlass v0.50

Automated release from a5441c7: Make the web tsconfig work on TypeScript 7 (#62)