v2.2.7

What's Changed

Aivory 2.2.7 is a security and reliability release that hardens authentication, authorization, OAuth/OIDC, billing, file access, and concurrent administrative operations. It also makes version-pinned Docker deployments deterministic across the application and sandbox images.

Security and Authentication

• Separated access-token and refresh-token validation so refresh credentials cannot be accepted as API access tokens.
• Made refresh-token rotation and one-time authentication credentials atomic, preventing concurrent reuse and multiple successor sessions.
• Serialized first-instance administrator bootstrap and last-administrator protection to close privilege and role-management races.
• Hardened public shares, files, conversations, messages, projects, knowledge bases, workspaces, storage quotas, and administrative resources against cross-user access.
• Added standards-compliant OIDC ID token verification, including issuer, audience, signature, nonce, and time-based claim validation.
• Added a dedicated generic OAuth 2.0 provider type for providers that do not expose OIDC issuer or JWKS metadata.
• Enforced administrator registration policy across OAuth sign-up, password recovery, email verification, CAPTCHA, 2FA, and password-change flows.
• Invalidated active sessions after password recovery and made email verification fail closed when delivery or configuration is unavailable.
• Hardened OAuth state, cross-domain handoff, identity linking, provider secrets, payment state, and other single-use flows against concurrent replay.

Deployment and Upgrades

• Fixed PostgreSQL upgrades that could fail with column "session_id" does not exist by creating and backfilling the refresh-session column before its index.
• Made the production Compose stack image-only so a pinned release cannot be silently replaced by a local source build.
• Made IMAGE_TAG select the same version for aivory-app, aivory-sandbox, and aivory-sandbox-sidecar by default.
• Added matching semantic-version tags for future application and sandbox image releases.
• Added deployment regression coverage for image tag inheritance, historical sandbox overrides, and migration ordering.

Administration and Billing

• Expanded usage, billing, feedback, file, workspace, and model analytics with clearer operational breakdowns.
• Added configurable memory and usage defaults to the administrator settings surface.
• Hardened credit, quota, payment, and stopped-generation accounting so concurrent requests remain authoritative and attributable.
• Preserved OAuth provider client secrets correctly and tightened provider configuration validation.

Chat and Reliability

• Added image-only vision messages without requiring placeholder text.
• Improved interrupted generation, fallback, EOF retry, canceled ingestion, and empty task-output recovery.
• Refined thinking and dialog presentation, registration consent, email-delivery guidance, and feedback previews.

Upgrade Notes

• Database migrations run automatically; no manual SQL migration is required.
• For Docker deployments, set IMAGE_TAG=2.2.7 and leave SANDBOX_IMAGE_TAG unset so all three Aivory images use 2.2.7.
• Wait for the application image workflow and sandbox image workflow to finish before pulling the new release.
• Historical releases such as 2.2.6 still require SANDBOX_IMAGE_TAG=latest because matching historical sandbox tags were not published.

Validation

• 55 frontend test files and 345 frontend tests passed.
• 7 sandbox deployment tests passed.
• The complete Go test suite, ESLint, and the production frontend build passed.

Full Changelog: v2.2.6...v2.2.7