Skip to content

Release v1.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jun 17:40
· 28 commits to main since this release
v1.2.0
378342a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Minor Changes

  • 0b33cdd: Harden security across configuration, auth, and HTTP headers.

    Requires running DB migrations on deploy (two migrations included).

    Configuration & API surface:

    • Explicit auth config on users and clients (2h token expiration, 5 max login attempts, 10 min lockout, secure cookies in production, sameSite: Lax)
    • Add serverURL, CORS and CSRF whitelists scoped to NEXT_PUBLIC_BASE_URL
    • Disable the unused GraphQL API and remove its routes to shrink the public API surface
    • Restrict Media uploads to images and cap file size at 5 MB

    Auth & data:

    • Enforce a minimum password length of 15 characters (NIST) on users and clients
    • Enable versioning/audit history on plans and clients (migration 20260618_162028_security_versioning)
    • Drop the share-links version tables and type to avoid retaining live tokens in history (migration 20260618_172305_drop_share_links_versions)

    HTTP security headers (next.config.ts):

    • HSTS (with preload), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and a frame-ancestors 'self' CSP

Pull Requests

No merged pull requests found for this release.

Full Changelog: v1.1.1...v1.2.0

Assets 2
Loading