Skip to content

Chart 0.2.48 [Account 3.32.0]

Latest
Latest

Choose a tag to compare

View all tags
@ozerovgithub ozerovgithub released this 05 Nov 10:30
0.2.48
a8d81f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Chart 0.2.48 [Account 3.32.0] - 2026-10-26

Cumulative changes since chart 0.2.42 (includes 0.2.43–0.2.47).

Application Versions

  • account-frontend: 3.32.1 (subchart 0.1.43)
  • account-auth: 3.32.0 (subchart 0.1.44)
  • account-workspace: 3.32.0 (subchart 0.1.44)

Before you upgrade

  • A database migration (000089_logins_domain_index) runs automatically on startup.
  • LiteLLM users: teams created before this release keep the default model group. After deploying, run scripts/litellm_teams_all_proxy_models.sh (dry run by default, --apply to write), and only then remove the default group from the LiteLLM proxy config.
  • LDAP users: do not set auth_providers.ldap.idp_entity_id until the role/group maps are configured — once it is set, every login reconciles roles against the directory and removes roles that no map grants.
  • No changes to existing values are required; all new keys are optional.

Security

  • account-frontend image moved to nginx:stable-alpine3.24 (nginx 1.30.6, Alpine 3.24) — the previous Alpine 3.20 base is end-of-life; fixes vulnerabilities in brotli (CVE-2026-111497 / USN-8956-1), curl, libxml2 and OpenSSL. No known OS-package vulnerabilities in the 3.32.1 image (amd64 and arm64)
  • account-frontend: DOMPurify updated to 3.4.17 (XSS fixes)
  • Content Security Policy hardened: removed the https://*.ngrok-free.app origin, added object-src 'none' and base-uri 'self'
  • OAuth2: authorization codes are bound to the client's redirect_uri, the code exchange is authenticated (client_secret, PKCE S256) and codes are single use; open redirect via //host paths closed
  • OAuth2: full-scope Simulator tokens are issued only to the Simulator client
  • LDAP: a first LDAP login is never linked to the super admin account by email; the login is escaped in the LDAP search filter
  • SAML: SSRF protection when fetching IdP metadata URLs — https only, private/loopback/cloud-metadata addresses refused; on-prem IdPs can opt in per provider with allow_private_metadata_url
  • Go runtime updated to 1.26.9 with dependency security fixes

New Features

  • LDAP / Active Directory
    • Display name and email read from the directory (user_nick_entry / user_email_entry); a first LDAP login reuses the existing account with that email or creates a new one; entries without a usable email are refused
    • Workspaces, roles and groups synced from the directory at login (same mapping as SAML), enabled with idp_entity_id; the sync never blocks a login
    • LDAP provider visible in the IdP settings API (the bind password is never returned)
    • Active Directory support: connect/read timeouts (default 10s), fallback_hosts for several domain controllers, clear wrong-password / disabled-account errors instead of internal errors; logins up to 100 characters (fits a userPrincipalName)
  • Search
    • Users can be searched by login domain: @example.com matches only that domain, example.com matches the domain or regular text
    • Licenses can be searched by license id, type, owner name, login or login domain, ordered by relevance
    • User picker shows the contacts you select most often first
  • AI / LiteLLM: the model is set in the account config (litellm.model, default claude-sonnet-5; must match a model_name on your LiteLLM proxy)

Enhancements

  • Avatars — faster delivery (account-frontend nginx; settings under global.account.frontend.avatars.*, see README "Avatar delivery"):
    • Browser caching: versioned avatar URLs (?v=<N>) are cached for a year, others for a day, placeholders for 2 minutes (avatars.cache.*)
    • Resized poster frames for animated avatars (/avatars/animation/<WxH>/<id>.jpg), cached on the pod (avatars.poster.*, enabled by default)
    • Animated avatars are encoded for delivery (480px H.264, starts playing immediately; 400–800 KB → 60–80 KB) and posters are stored as real JPEG
    • Optional nightly CronJob (avatars.normalize, disabled by default) converts already stored avatars to the same format; originals are kept under <volume>/.orig/, dry_run and limit available. One-off run: kubectl -n <ns> create job --from=cronjob/<release>-avatars-normalize avatars-normalize-backfill
  • Barrier limits: the monthly usage window is now a stable calendar month instead of a rolling one

Bug Fixes

  • Avatars: unsupported avatar URLs return 404 instead of a redirect to a placeholder or a 415 error; users without an avatar get the placeholder directly
  • nginx JSON access log is valid JSON for static responses; expected avatar misses are no longer logged as errors
  • SAML/LDAP role sync: system groups (All Workspace Users, Admin, Member, Guest) are no longer touched by group maps — fixes a 400 error on LDAP login and users being removed from All Workspace Users
  • LDAP: attribute names are matched case-insensitively (name/email were empty on some directories)
  • Login no longer fails with 500 when the browser sends several token cookies (e.g. from another app on the parent domain)
  • SAML: the stored IdP metadata is kept when a metadata refresh fails
  • Workspace: fixed a crash when several pods start for the first time at once
  • Cloud deployments: secrets from AWS Secrets Manager load correctly at startup
Assets 2
Loading