Skip to content

v0.6.0

Choose a tag to compare

View all tags
@sagarsuperuser sagarsuperuser released this 13 Oct 12:54
· 343 commits to main since this release
v0.6.0
1397daf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes from a security review and a billing audit, plus dashboard screens for subscriptions whose billing is failing. No database migration.

Before you upgrade

  • Set METRICS_TOKEN if you scrape /metrics in production. With APP_ENV=production and no token, /metrics now answers 401. The Compose stack runs in production mode.
  • Check three settings. Velox now refuses to start on an APP_ENV such as prod (it must be production), a TRUST_PROXY entry that is not an IP or CIDR, or a DB_* pool setting that is not a whole number.
  • GET /health/ready no longer fails when the billing scheduler stalls. It answers 503 only while draining or when the database ping fails. Alert on velox_scheduler_last_run_timestamp_seconds instead.
  • A cancel can answer 409 unbilled_period when a billing period has ended and cannot be invoiced. Retry billing, then cancel again. If you script cancels, handle this code.
  • Several endpoints answer 404 or 422 for an id that is not yours, where they used to answer 2xx.
  • Webhook endpoints in 100.64.0.0/10 are refused. Some private overlay networks use that range.
  • Images are signed with cosign 3. Verifying an image from this release needs cosign 3 or newer.

What changed

Billing

  • A subscription cancelled after its billing period ended, and before the billing run invoiced it, is now billed for that period. Before, that period's usage and base fee were never invoiced. (#991)
  • Cancelling just after a renewal no longer voids the previous period's usage on a plan billed in advance.
  • Usage ingest answers 503, not 422 "not found", when the database cannot look up the customer or meter. A client that treats a 4xx as final dropped that usage.

Dashboard

  • Subscriptions whose billing is failing are marked in the list, with a Billing failing filter. The subscription page shows the reason, which attempt failed, when the next one is, and a Retry billing button. (#960)
  • A price box left blank no longer saves a $0 rate.
  • A failed load on the customer page shows an error with Retry, not "$0.00" or a blank setup form.

Security

  • Eleven endpoints accepted the id of an object in another tenant, or in the same tenant's other mode (live or test), and wrote a row under the caller's tenant pointing at it. They now refuse it and write nothing. The customer's owner got no spendable credit from this. The changelog lists the endpoints and says how to find rows written earlier.
  • Webhook deliveries check the address they connect to, not only the host name.
  • /metrics requires a bearer token in production.
  • The readiness check no longer returns database error text.
  • A sent email's database row no longer keeps its link token or PDF. Rows from before this release are not cleaned up.
  • A failure at the end of an API key rotation answers a logged 500, not a 422 carrying the error text.
  • The dashboard image is now scanned and signed, and moves from nginx 1.27 to 1.30.

Email

  • A network error while sending no longer marks the customer's address as bounced.

Docs

  • Billing thresholds are described as what they are: an early invoice, once per period, at the next hourly billing run. They do not stop usage. The page said "hard cap".

Every change, with its reasoning: CHANGELOG.

Assets 3
Loading