Skip to content

CompDesk v0.9.0-beta.4.1 — Public Beta

Choose a tag to compare

View all tags
@TahaHydra TahaHydra released this 13 Oct 18:12
· 15 commits to main since this release
v0.9.0-beta.4.1
da7c983

CompDesk v0.9.0-beta.4.1 — Public Beta

A fix release for beta.4: OpenID Connect sign-in now works with providers that return the user's email only from the userinfo endpoint (such as Authelia), and first-run setup can no longer replace the secrets of an existing installation.

Fixes

  • OpenID Connect sign-in with Authelia and similar providers. CompDesk read the user's email and name only from the ID token. Authelia 4.39 and later, by default, return these claims only from the userinfo endpoint, so first-time sign-ins were refused with "The account is not permitted to sign in". CompDesk now reads the profile from the userinfo endpoint after validating the ID token and matching its subject. Account identities are unchanged: they remain bound to the ID token's issuer and subject, so existing links keep working. A provider that reports email_verified as false (boolean or string) is still refused.
  • Setup could replace the secrets of an existing installation. When the configuration volume (/config in Docker) lost its files while the database still held an installation, CompDesk returned to first-run setup on every start. Running setup again was refused as "already installed" — but only after it had already written a new runtime configuration with new AUTH_SECRET and APP_SETTINGS_ENCRYPTION_KEY values, which made encrypted settings such as the SMTP password unreadable. Setup now detects an existing installation during the database check, refuses before writing anything, and explains how to recover. The startup log also points to the configuration volume when setup starts.
  • Documentation. Docker troubleshooting now covers "Setup says CompDesk is already installed" and lists the three container paths a hand-written Compose file must persist: /config, /app/public/uploads and /app/storage/attachments.
  • Dependencies. Next.js is updated from 15.5.25 to 15.5.27 to address two cache-poisoning advisories (GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p). The production dependency audit has zero findings.

Upgrade and rollback

There are no database migrations in this release. Back up PostgreSQL, private attachments, uploaded branding, and the private configuration volume together. Download this release's version-pinned docker-compose.yml, review it against your deployment configuration, then run from the deployment directory:

docker compose pull
docker compose up -d
docker compose logs --tail=100 compdesk

If you deploy with your own Compose file, change only the image tag to ghcr.io/tahahydra/compdesk:0.9.0-beta.4.1 and confirm the three persistent paths above are mounted.

Rolling back to beta.4 needs only the beta.4 image; the database and configuration are unchanged. See upgrade guidance and backup/restore.

Verification

  • Lint, type checking, the full Jest suite (626 tests), the script test suites and the production build pass.
  • An Authelia-like provider (email and name only from userinfo, bare-origin issuer) was reproduced locally: beta.4 refused a first-time sign-in with AccessDenied; this release signs the user in with the correct email and name and an issuer-scoped identity. An already-linked user and a refused unverified email were also checked.
  • A Docker deployment using a reporter's hand-written Compose file (bind mounts, external DATABASE_URL, reverse-proxy origin) was installed and restarted. With an emptied configuration volume, a repeated setup is now refused without writing any file, and restoring the configuration backup returns the installation to production.

This is a public beta; the beta.4 limitations still apply.

Publication checks

Verified release source: da7c983bea80fbbefc75fb21876e744a5850d532.

  • Main CI and main Security passed, as did all checks on the pull request.
  • Tagged-image scan and publication passed. The released image digest is sha256:bfbc5783b36308d2f57d430e1daaeff297c6c32e86b84dcafc9b99ce587c3fdc.
  • The published image runs as UID 1001, reports version 0.9.0-beta.4.1 and contains Next.js 15.5.27. The production dependency audit has zero findings.
  • The image manifest was resolved anonymously, without GitHub credentials.
Previous releases and rollback downloads
Assets 3
Loading