v0.1.8

Changed

• Visual Studio solution versioned with the repository (Kubuno.Office.slnx, generated by vskubuno, the naming of
  every Kubuno repository): the server is the project Kubuno.Office.Server, the frontend Kubuno.Office.Web, in
  the solution folders Server, Libraries and Frontend, with the shared launch profile "Office (Kubuno Core + browser)".
  The crate and npm names do not change.

Fixed

• Database migrations keep the same checksum on every OS. The repository now
  pins line endings to LF (.gitattributes), so a checkout on Windows no longer
  turns SQL migrations, scripts, manifests or sources into CRLF. A database
  migrated by a Linux build is therefore no longer refused by a Windows or macOS
  build of the same version because its migration checksums differ.

• Syncing documents works again. The endpoint a syncing client asks for the
  list of changes since its last pull (GET /documents/delta) answered with a
  server error every single time, so nothing could ever be synced: the query had
  not been updated when documents gained an origin-format field, and the missing
  column broke the whole response. Listing documents was unaffected, which is
  why the failure looked like it came from the sync client.

• Documents now hand out their version marker on opening. Reading a document
  (GET /documents/:id) and starting an editing session
  (POST /documents/:id/editing/join) returned the document without its etag
  and content_etag, which a client needs to send If-Match on its first save.
  Until it had made one write it had no marker to quote, so two people — or one
  person on two devices — could silently overwrite each other on that first
  save; the conflict check only protected later writes. Both endpoints now
  return the markers, and joining an editing session returns the document
  itself alongside the editor list.

• A retried write is no longer replayed for ever. The store that lets a
  client safely retry a create or an edit (the Idempotency-Key header) kept
  every entry for the life of the instance. A client reusing a key weeks or
  months later — after reinstalling, or because it recycles its key space — got
  the old answer back and its new edit was silently dropped, and the table grew
  without limit. Replays are now honoured for 24 hours, the usual window for
  this, after which the key is treated as new and the entry is cleaned up in the
  background.

• A new document no longer claims to come from a Word file. Every document
  and every workbook created in Office was stamped with the instance's default
  save format, so it reported itself as imported from a .docx (or an .xlsx
  for a workbook) although nothing had been imported. The format badge was
  wrong, and "save back to the source" was offered where there was no source
  file to write to. Only documents and workbooks actually opened from a foreign
  file now carry an origin format; existing ones that never had a source file
  are corrected on upgrade. Document listings also report the origin format now,
  so a client no longer has to open each document to know whether it has one.

Security

• Real-time collaboration (documents, whiteboard), script run logs, imported fonts and images inserted
  from Drive or Photos no longer rely on the access-token cookie the web client used to keep readable by
  page scripts, nor put the access token in WebSocket URLs. Sockets and event streams present a
  one-minute (respectively stream) signed ticket; stored image and font addresses stay plain and are
  signed when they are loaded. Fonts imported from Drive now load as fonts instead of being injected as a
  stylesheet. Requires a Kubuno core that issues signed tickets (POST /api/v1/auth/tickets) and @kubuno/sdk with the signed-URL helpers.
• XML reader updated to a patched release. A crafted document could drive
  it into quadratic time or unbounded memory (RUSTSEC-2026-0194,
  RUSTSEC-2026-0195). Every document this module converts goes through it.
• The Data module no longer runs SQL written by whoever calls it. Two
  endpoints — the dataset SQL check, and widget execution — took text from the
  request body and executed it on the module's own database connection, which
  owns every office schema. Any signed-in account could therefore read or
  destroy every other account's documents, projects and collaboration state. No
  administrator role was needed. Instances running 0.1.7 are affected and
  should upgrade. Both endpoints now refuse, with an explanation; they will
  return once queries run under a role restricted to what the Data module may
  read, and a validator that parses a statement instead of asking the database
  to plan it.
• Database driver updated past an unfixable advisory. The previous line
  pulled in an RSA implementation vulnerable to a timing side-channel
  (RUSTSEC-2023-0071) for which no fix will ever exist. The new line does not
  depend on it at all, and it refuses any SQL string built at run time unless it
  has been audited — every query here was traced back to its source and
  rewritten so the compiler itself proves the statement is a fixed literal.
• Input validation library updated. The version in use carried
  RUSTSEC-2024-0421 through its domain-name parser, which accepted Punycode
  labels that decode to plain ASCII — a mismatch an attacker can use to make two
  different names look like one.