Skip to content

v2.17.0 — security P0 + multilang wakewords + i18n + Paperless async decouple

Choose a tag to compare

View all tags
@ebongard ebongard released this 02 Jul 12:41
· 458 commits to main since this release
v2.17.0
7d1259e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v2.17.0

Audit-trail release covering everything merged to main since v2.16.0. Most of
this is already running in production from earlier image builds; this tag
catches the git history up.

Security (P0/H-series hardening)

  • P0 batch (#878): fail-closed permission checks + blacklist + RAG circle-filter,
    fail-closed JWT key, WS cross-user conversation IDOR (H2), KG read/WS access
    gating (H3/H4), owner-scoped WS push registration (#657), SECRET_KEY entropy
    guard (#692), AdaptiveCard URL-scheme allowlist (M3), voice-server fail-closed
    key + concurrent-session cap (M4), Paperless TLS.
  • Satellite enrollment credential (H1): per-device 256-bit PSK (bcrypt at rest),
    permissive→enforcing state machine, admin/provisioning UI, dark by default.
  • Signed OTA packages (H6): Ed25519-signed source manifest, satellite verifies
    before install; dark by default.
  • Surgical pre-batch fixes: OTA download TLS, BLE IRK push allowlist.

Folder / Email auto-ingest → async Paperless (Design Z)

  • Decouple Paperless filing from the ingest request path — the push stamps
    paperless_state='pending' and returns; no external round-trip on a pooled DB
    connection (fixes the 2026-07-01 pool-exhaustion outage).
  • Paperless filing runs in the document-worker (Docling's home) as a
    post_document_ingest hook reusing the worker's OCR; fixes the interim
    backend-side OOM/CrashLoop.
  • Best OCR transported into Paperless searchable content.
  • Backend reconciler is a light re-enqueuer with a per-doc refile lease, owner
    threading, and a NULL-processed_at guard; new PAPERLESS_RECONCILER_* env vars.
  • Dedicated high rate limit for the token-authed push routes.

Voice / wakewords / satellites

  • Per-language "Renfield" wakeword models: renfield_de (real-ambient FP hardened),
    renfield_en (US+UK), renfield_it, with multi-keyword loading.
  • Satellite: Tier-2 backend-link watchdog, XVF3800 PortAudio/ALSA pulse-plugin
    hang fix, WM8960 ALC, WiFi/journald stability, Esszimmer pod image v6 (sat v1.4.6).

i18n

  • Complete Italian locale + wiring; SUPPORTED_LANGUAGES default now de,en,it;
    hardened previously-hardcoded UI strings.

Other

  • db connection-pool headroom raised then superseded by the Design-Z decouple.
  • Chat: "continued in {room}" handoff chip.

🤖 Generated with Claude Code

Assets 2
Loading