v2.0.1

2.0.1 (2026-04-16)

Security

• dompurify CVE fix: Bump dompurify to fix CVE GHSA-39q2-94rc-95cp (ADD_TAGS bypasses FORBID_TAGS)
• CSP hardening: Replace script-src 'unsafe-inline' with SvelteKit CSP nonces via kit.csp (per-request nonce generation)
• Auth logging: Gate auth logs to debug() level to prevent user-login leaks to stdout in production
• Remove hardcoded secret fallback: Require SESSION_SECRET via fail-fast validation
• CI audit gate: Upgrade from 'high' to 'moderate' level, remove continue-on-error
• Document ALLOWED_GITHUB_USERS: Promote as critical security setting for self-hosted deployments

Bug Fixes

• Critical: Node 25 SSR localStorage bug: Fix hard 500s on every page load
  • Node 25+ exposes a broken localStorage stub without --localstorage-file
  • Replace typeof localStorage === 'undefined' guards with window.localStorage?.getItem feature checks
  • Applied to: settings.svelte.ts, ws.svelte.ts, test-setup.ts polyfill
• resolve Svelte warning and optimize Docker layer caching (7a21ec0)
• suppress npm install warnings in Docker build (d570304)

Internal

• Remove duplicated auth-cookie restore from server.js
• Centralize TOKEN_MAX_AGE_MS via config.ts
• Remove auth-aware '/' from service worker precache
• Make logger build-time-safe (read NODE_ENV directly)
• Fix 7 pre-existing settings.test.ts failures (localStorage.clear stub + stale v2 voice fields)
• Verify cookie ^0.7.0 override still needed (kit requires ^0.6.0 which is vulnerable)

Testing

• All 409/409 unit tests pass (up from 402)
• npm audit clean (0 moderate+ vulnerabilities)
• Production verified: HTTP 200, CSP nonce per-request, zero per-request log noise