Skip to content

v0.61.130

v0.61.130
@mosamlife mosamlife tagged this 10 Aug 06:48 
Covers 0.61.128 to 0.61.130. Self-hosted installs have been stuck on 0.61.127
since 2026-08-06 while production ran ahead; this tag closes that gap, and two
of the entries below are security fixes those installs have been missing.

0.61.130
  Google and GitHub sign-in, off until an operator configures a provider.
  SECURITY: a disabled user could still sign in through single sign-on. The
  password path had always refused disabled and unverified accounts; the single
  sign-on route refused neither.
  SECURITY: single sign-on could attach an identity to an account whose address
  nobody had ever confirmed, so somebody who registered an address ahead of its
  real owner kept access to the account that owner then signed in to.

0.61.129
  Both of the above came from the sign-on rules existing twice in the codebase,
  once per route, with only one copy kept current. There is now a single set of
  rules every provider goes through.
  Accounts never sent a verification email, which includes the first account on
  a new install and everyone added by invitation, can now request one.

0.61.128
  Creating an account asks for an email address and a password, and nothing
  else. An account's organisation is named from the signup email instead of
  being called Default; existing accounts keep their name.
Assets 2
Loading