2.0.0

What's Changed

Added

• User and group management (#376)
• Emergency Access: Allow a council to restore access to a orphaned vault (#390)
• Initial setup flow: fresh installations now show a setup screen on first start (#480)
• Admins can enter and update the license key directly in the UI (#479)
• Grace period of 9 days after license expiry: vaults stay accessible during this period and a banner prompts to renew the license (#485)
• Allow admins to archive and unarchive any vault (#283, #430)
• Disable users to exclude them from license seat count (#427, #428)
• Emergency Access warning badge in the vault list
• Archived badge for vaults in the user detail view
• Display a banner to indicate that legacy devices are still in use (#420)
• Show pictures of the groups in the Vaults member list (#375)
• Published Helm chart, including a values schema (values.schema.json) and Rancher app questions (#406, #456)
• Deployment examples for Docker Compose and Helm in deploy/
• Added DELETE /api/vaults/{vaultId} api endpoint
• Container image digests are published for reproducibility

Changed

• Replaced the top navigation bar with a sidebar (#464)
• Updated logo and favicon to the new Hub branding
• Updated to Java 25 and Quarkus 3.33.2.1 LTS (#469)
• Updated Keycloak to 26.7.3 (including Helm chart)
• Helm chart now defaults to Postgres 18 (the new volume layout requires Postgres >= 18)
• Added OpenTelemetry support for metrics, traces and logs (#443)
• OpenTelemetry SDK is now disabled by default (set QUARKUS_OTEL_SDK_DISABLED=false to enable)
• Moved health check to separate service port (configurable via QUARKUS_MANAGEMENT_PORT) (#443)
• Migrated frontend package management from npm to pnpm (#446)
• Updated frontend toolchain to TypeScript 6, Vite 8 (Rolldown) and Node 26 (#482)
• New Flyway base migration B28 plus incremental migration to align existing databases, including a migration path for Hub 1.3.4 (#467, #468)
• Device "last access" is now stored as a column instead of being derived from audit log events (#466)
• Keycloak realm roles are no longer persisted in Hub's database (#465)
• Merged KeycloakAdminService into KeycloakAuthorityPuller (#463)
• Audit log events containing raw JSON are now rendered as prettified details (#484)
• Audit logs are now presented as a paid feature instead of an enterprise feature
• Setting the license via ?token= callback URL is no longer supported, use the new license dialog instead
• License refresh is now session-based
• Improved browser locale detection (#371)
• Improved efficiency of keycloak-to-hub data sync (#377)
• Improved efficiency of group-based access permission checks (#372)
• Migrated aes-siv and base encoding libraries to @noble/ciphers and @scure/base (#373)
• Improved user search
• New users' initial passwords are now always temporary
• Added @NotNull annotations to improve the generated OpenAPI type definitions
• Updated translations

Fixed

• Fixed "Claim Vault Ownership" failed for vaults created with Hub 1.4.x or older (#403)
• Check seat limit before unarchiving a vault, ensuring smooth operations without unexpectedly exceeding license limits (#431)
• Fixed "Last Access" field (user detail page or admin device listing) was last date of any unlock attempt (#466)
• Creating user with sole role create-vault was unable to login due to missing role user
• Fix disabling users via user and group management
• Admins can no longer delete or disable their own account or revoke their own admin role
• Fixed Web of Trust setup
• Fixed false "unsaved changes" indicator after saving Emergency Access settings (#425)
• Fixed misplaced validation tooltip in the Emergency Access settings (#439)
• Improved Emergency Access UX on mobile and touch devices (#424, #440, #442, #454)
• Truncate long names in detail cards and breadcrumbs (#437)
• Added client-side form validation during vault creation

Security

• Fixed CVE-2026-64674: Emergency Access Authorization Bypass
• Fixed CVE-2026-64681: Unauthorized Read/Delete of Recovery Process State
• Fixed CVE-2026-64683: Endpoints Accepts Invalid / non-JWE Key Material
• CVE-2025-64756, CVE-2025-64118: removed glob and tar dependencies
• CVE-2025-64718, CVE-2025-62522: updated js-yaml and vite

Required actions for the 2.0.0 update

Important

Back up your database before you upgrade.

Health check port

The default health check port changed from 8080 to 9000 (configurable via QUARKUS_MANAGEMENT_PORT). Adjust your probes:

Docker Compose:

     healthcheck:
       test:
         - CMD-SHELL
-        - (curl -f http://localhost:8080/q/health/live && curl -f http://localhost:8080/api/config) || exit 1
+        - (curl -f http://localhost:9000/q/health/live && curl -f http://localhost:8080/api/config) || exit 1
       interval: 10s
       timeout: 3s

Kubernetes:

           startupProbe:
             httpGet:
               path: /q/health/started
-              port: 8080
+              port: 9000
           ...

Keycloak

We highly recommend updating Keycloak to version 26.7.3.

PostgreSQL (Helm chart only)

The bundled PostgreSQL now defaults to 18-alpine. The volume layout requires PostgreSQL >= 18, because PGDATA moved to /var/lib/postgresql/<major>/docker. If you pin postgres.image.tag, pin it to 18 or later.

Metrics, traces and logs

The OpenTelemetry SDK is disabled by default. To export telemetry, set QUARKUS_OTEL_SDK_DISABLED=false.

License

The ?token= callback URL no longer sets the license. Enter the license key under Admin → License → Update License Manually instead.

Full changelog: 1.4.7...2.0.0