release 1.0.3

[Polliog]

Release 1.0.3 (2026-06-26). Promotes the current develop line to main. No database migrations; drop-in upgrade.

This is a security-focused release.

Security

Resolves a batch of privately reported issues (coordinated disclosure via KIberblick.de):

• Cross-tenant read on the dashboard API endpoints - org was taken from the attacker-supplied query string under API-key auth; now routed through a shared resolveDashboardScope that binds org/project to the key (fix cross-tenant dashboard read and service-map stored xss #262).
• Stored XSS via OTLP service.name in the service map - user-derived tooltip values are now HTML-escaped at the sink (fix cross-tenant dashboard read and service-map stored xss #262).
• Open redirect on auth-free login/register - the redirect param is now validated by a shared isSafeInternalPath/safeRedirect on every path (harden auth-free redirect, ssrf pinning, first-admin and quota races, service.name #263).
• DNS-rebinding gap in the SSRF guard - the HTTP(S) path now pins the connection to the validated IP via a per-request undici dispatcher (harden auth-free redirect, ssrf pinning, first-admin and quota races, service.name #263).
• First-admin bootstrap promotion race - the check+insert now runs under a Postgres advisory lock (harden auth-free redirect, ssrf pinning, first-admin and quota races, service.name #263).
• Capability-limit check-then-act race - count+create now serialized per org+capability via withLimitLock (in-process mutex over an advisory lock) (harden auth-free redirect, ssrf pinning, first-admin and quota races, service.name #263).

Also: trace span attributes are now PII-masked, and service.name is sanitized at ingestion as defense in depth.

Other changes (since 1.0.2)

• Sigma detection honors full SigmaHQ field-modifier chains; service-map p95 is a true window percentile on every storage engine (issue Bug-hunt follow-ups: Sigma compound modifiers + true service-map p95 #255).
• Multi-engine reservoir.getSpanTimeseries so trace volume/latency panels work on ClickHouse and MongoDB.
• Activity Overview on the project overview page; admin usage access fix; en-US locale sweep.
• Operational fixes: Redis memory leak (BullMQ job retention) and a nightly SigmaHQ sync that re-imported the whole catalog as enabled.

Full detail in CHANGELOG.md under [1.0.3].

After merge: tag v1.0.3 on main.

[codecov]

Codecov Report

❌ Patch coverage is 85.58140% with 124 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...es/reservoir/src/engines/mongodb/mongodb-engine.ts	52.05%	35 Missing ⚠️
...ervoir/src/engines/clickhouse/clickhouse-engine.ts	50.79%	31 Missing ⚠️
...ackages/backend/src/modules/sigma/field-matcher.ts	87.92%	25 Missing ⚠️
packages/reservoir/src/client.ts	16.66%	10 Missing ⚠️
packages/backend/src/modules/dashboard/routes.ts	93.06%	7 Missing ⚠️
...ackages/backend/src/modules/pii-masking/service.ts	90.90%	7 Missing ⚠️
packages/backend/src/modules/traces/service.ts	79.16%	5 Missing ⚠️
packages/backend/src/utils/ssrf-guard.ts	93.10%	2 Missing ⚠️
packages/backend/src/modules/metering/routes.ts	90.90%	1 Missing ⚠️
packages/backend/src/modules/sigma/routes.ts	95.65%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!