v0.1.9

Changed

• Visual Studio solution versioned with the repository (Kubuno.App.slnx, generated by vskubuno, the naming of
  every Kubuno repository): the server is the project Kubuno.App.Server, the frontend Kubuno.App.Web, in
  the solution folders Server, Libraries and Frontend, with the shared launch profile "App (Kubuno Core + browser)".
  The crate and npm names do not change.

• Runs on PostgreSQL, MySQL/MariaDB or SQLite. The module moves off a
  PostgreSQL-only stack onto the runtime-dispatch kubuno-db foundation, so a
  single binary connects to whichever engine the administrator chooses at run
  time ([database] engine). Existing PostgreSQL instances are unaffected: their
  migrations are unchanged and re-used as-is.

Fixed

• Database migrations keep the same checksum on every OS. The repository now
  pins line endings to LF (.gitattributes), so a checkout on Windows no longer
  turns SQL migrations, scripts, manifests or sources into CRLF. A database
  migrated by a Linux build is therefore no longer refused by a Windows or macOS
  build of the same version because its migration checksums differ.

• The no-code data engine's filters work identically on every engine. The
  dynamic "Things" search (equals / contains / greater-than / in / is-empty …),
  which addresses arbitrary JSON keys chosen by the app builder, previously used
  PostgreSQL's ->> operator, whose path semantics differ on MySQL. Every JSON
  access now goes through a portable extraction that binds the key as data and
  emits the right form for the running engine, so the same app behaves the same
  everywhere. A record update's field merge (formerly PostgreSQL's data || patch) is computed in Rust so a null-valued key is treated identically on all
  three engines.

Security

• Data written by visitors and shared users is checked against the app's data
  types. On a published or shared app, a new or changed record must belong to a
  declared data type and contain only its declared fields, each with a value of
  the right type (text, number, yes/no, date, or one of an option's choices) and
  within size limits; anything else is refused. Changing or deleting a record
  through a published or shared app now only works on a record of the type named
  in the request, so a visitor can no longer alter or delete records of other
  (for example private) data types.

• Images, video and audio in apps and reports, PDF report images and collaborative editing no longer
  rely on the access-token cookie the web client used to keep readable by page scripts, nor put the access
  token in a WebSocket URL. Private addresses are signed when they are displayed and stay plain in the
  app definition; published apps viewed anonymously behave as before. Requires a Kubuno core that issues signed tickets (POST /api/v1/auth/tickets) and @kubuno/sdk with the signed-URL helpers.

• Security fixes from the shared database layer (kubuno-db 0.9.0). The
  database password can no longer appear in a log through the debug output of
  the database settings.

• Dynamic queries stay parameterised across engines. The no-code query
  builder (filters, sort, pagination) is rebuilt on kubuno-db's DbQueryBuilder
  under SqlSafeStr: the query structure is fixed text and every value — the
  JSON key included — is a bound placeholder, never interpolated, closing any
  path to SQL injection through a builder-supplied field name.

Security

• Database driver updated past an unfixable advisory. The previous line
  pulled in an RSA implementation vulnerable to a timing side-channel
  (RUSTSEC-2023-0071) for which no fix will ever exist. The new line does not
  depend on it at all. An unsoundness in the event-listener it relies on
  (RUSTSEC-2026-0221) is closed at the same time.
• Input validation library updated. The version in use carried
  RUSTSEC-2024-0421 through its domain-name parser, which accepted Punycode
  labels that decode to plain ASCII — a mismatch an attacker can use to make two
  different names look like one.

v0.1.8

Security

• HTTP/2 layer updated to a patched release. h2 moves from 0.4.15 to
  0.4.19, closing a denial of service through unbounded empty DATA frames
  (RUSTSEC-2026-0258).
• Error library updated to a patched release. anyhow moves from 1.0.102
  to 1.0.104, closing an unsoundness in Error::downcast_mut()
  (RUSTSEC-2026-0190).
• TLS library updated to a patched release. The pinned rustls carried
  RUSTSEC-2026-0285 (medium). Every outbound HTTPS connection goes through it.

v0.1.7

Changed

• This module now installs as a Kubuno package (.kbpkg) only. Its system
  packages (Debian/RPM and the Windows and macOS installers) are no longer
  built: the module is distributed as one .kbpkg per platform (Linux, Windows,
  macOS) that the Kubuno server installs itself — from the admin console, or
  offline with kubuno modules:install <file>.kbpkg.

• Dates are formatted by the platform now, not by a library. date-fns is
  gone from this module: the shared SDK exposes helpers built on Intl, which is
  localised for every language we ship and needs no locale bundle loaded. Call
  sites say what a date is FOR — formatDate(d, 'date') — and the platform
  decides how to write it, so a reader in Japanese no longer gets a French
  layout. Machine formats (keys, <input type="date"> values) go through
  toISODate and friends, built from local calendar fields so the day cannot
  shift near midnight.

• Class names are composed by cn() from @ui, replacing clsx. One less
  dependency for a dozen lines of finished logic; call sites are unchanged.

• The README now opens with the module's logo. The public README on
  GitHub now shows the module's designer logo (the same PNG shown as the
  browser tab icon and in the applications menu) at the top of the page — the
  repository landing now matches the icon a signed-in user sees inside the
  platform. The image ships in-repo, under .github/logo.png, so it renders
  even when the repo is browsed offline.

• New App logo — a blue hexagon with a stack of isometric cubes, used as the
  browser-tab icon and in the applications menu. It is now raster (PNG)
  designer artwork, and the browser-tab icon now resolves (the previous SVG
  path pointed at a missing file).

• Pill-shaped buttons are gone from the interface. Filter chips, view
  segments, tab selectors and action buttons that were drawn as pills now use the
  same 4 px corner radius as every other button — the shape set them apart for no
  reason other than habit. Round buttons that hold a lone icon, avatars, status
  dots and non-clickable badges keep their shape: a circle around a single glyph
  is not a pill.

Fixed

• A withdrawn dependency is no longer used. A crate deep in the tree
  (spin 0.9.8, pulled in through the HTTP stack) was yanked by its authors.
  No vulnerability was announced, but a withdrawn crate has no business in a
  release; the lockfile now takes the version that replaced it.
• The package could not be built where zip is absent. The Windows job of
  the continuous integration has no zip, so the Windows package was simply lost
  the first time it was attempted — a script failure, not a build failure. The
  builder now falls back to 7-Zip, then to PowerShell.

Added

• This module now ships a .kbpkg — the single package format a Kubuno
  server installs by itself, the same file on Linux, Windows and macOS. It
  carries the same binary, interface and manifest as the system packages,
  arranged the way the server expects to find a module on disk, plus a
  SHA256SUMS so a copy carried offline can be checked without the catalogue.
  Nothing changes for existing installations: the .deb, .rpm, .exe and
  .pkg are still published, and a catalogue that sees both simply prefers the
  new one. It is also the only format the server can unpack without an external
  tool, which is what makes one-click installation possible away from
  Debian-like systems.

Fixed

• A built package could be thrown away instead of published. The job that
  attaches a package to the release waited ten minutes for another workflow to
  create that release, then gave up with "release never appeared — build.yml
  likely failed". The diagnosis was wrong: on a repository whose .deb takes
  longer than ten minutes to build, the release simply did not exist yet, and a
  package that had built perfectly was discarded. Four modules reached v0.1.6
  with packages missing for some systems because of it. The job now creates the
  release itself when it is missing, so it no longer depends on another workflow
  finishing first.

Added

• Security policy and CI quality gate. A SECURITY.md documents how to
  report vulnerabilities, and a CI workflow enforces clippy -D warnings, a
  dependency-vulnerability audit (cargo audit) and the frontend typecheck/tests.

Security

• App now authenticates proxied requests from a signed token instead of
  trusting plain headers. Requests must carry a valid X-Kubuno-Auth token
  minted by the core with this module's internal secret (see kubuno-modauth),
  rather than reading X-Kubuno-User-* headers at face value — which any process
  reaching App's loopback port could otherwise forge to act as any user.

v0.1.6

kubuno-app v0.1.6

v0.1.5

kubuno-app v0.1.5