Skip to content

BugPin 1.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 21:13
v1.2.0
c81ef2c

Heads up before upgrading

  • A database migration adds a report_history table. It runs automatically on first launch; no manual step required.

Features

Unassigned filter

  • The Reports assignee filter now includes Unassigned, so you can list reports with no assignee.

Report activity history

  • Report detail shows a JIRA-style Activity timeline (created, status, priority, and assignee changes).
  • History is stored server-side and exposed via GET /api/reports/:id/history.

Share selected reports

  • Bulk actions replace Export Excel with a Share dropdown.
  • Download selected reports as Excel (.xlsx) or CSV (.csv).
  • Shared files include only Title, Description, and URL.
  • URL is the BugPin report detail permalink (/admin/reports/<id>), so recipients open the report in BugPin.

Fixes

  • Report export permalinks now use /admin/reports/<id>, matching email/notification links and the real Admin Console route (previously /reports/<id> omitted the /admin basename).
  • Reports list pagination no longer resets to page 1 when using Next/Previous.
  • The documented bun run reset-password <email> command now exists. It generates a temporary password for a locked-out account and invalidates that user's sessions. Runs from the container root, matching the docs (docker exec -it bugpin bun run reset-password <email>).

Security

  • Avatar serving is now confined to the requesting user's own directory. Path traversal in the GET /api/users/me/avatar/:filename route is rejected (encoded .., path separators, and NUL bytes), so a crafted filename can no longer read files outside the avatars directory.
  • Report updates (PATCH /api/reports/:id) now use the validated request body instead of the raw payload, dropping the forwardedTo field. This closes a mass-assignment gap where clients could inject forwarded-integration references directly.
  • Invitation acceptance consumes its token atomically. Concurrent accepts for the same token can no longer both succeed, preventing duplicate account activation or token reuse.
  • Bumped sharp to ^0.35.3 (libvips 8.18.3) to resolve GHSA-f88m-g3jw-g9cj, a high-severity advisory affecting image processing of untrusted input in versions prior to 0.35.0.

Maintenance

  • Added xlsx for Excel share downloads; downloads use a shared blob helper that revokes object URLs after download.

Compare: v1.1.1...v1.2.0

Assets 2
Loading