Release v0.12.0 · nogoo9/no-crd

[0.12.0] — 2026-07-06

Non-Blocking Workspace Template Upgrades (ADR-024): Implemented asynchronous background upgrade processing for running workspaces, allowing long-running workspace migrations to run without client-side timeouts.
RWO Volume Recreate Fallback: Automatically fallback to recreate-style upgrades when PersistentVolumeClaims (PVCs) use ReadWriteOnce mode, preventing multi-pod mounting conflicts.
Upgrade Failure Logs: Added a nogoo9/last-upgrade-error annotation to preserve detailed logs on the old pod if a background upgrade fails.
Upgrades Documentation: Added a dedicated VitePress guide for workspace upgrades and template versioning.

Spawner Module Consolidation: Refactored and incorporated spawner entry point (src/mcp/spawner.ts -> src/mcp/spawner/index.ts) and test files into the spawner sub-package directory.
Simplified Handler Architecture: Modularized handler code in src/mcp/spawner/handlers.ts to delegate to extracted helper modules in helpers.ts.

CVE Mitigation & Package Hardening: Upgraded nested dependencies (dompurify, form-data, undici) to secure versions via overrides/resolutions.

Cookie TTL Alignment: nocr_token cookie Max-Age is now derived from the JWT exp claim and nocr_refresh from the IdP's refresh_expires_in field, preventing stale cookies from outliving their tokens. Configurable fallbacks via PROXY_TOKEN_COOKIE_TTL and PROXY_REFRESH_COOKIE_TTL.
Stale Refresh Cookie Cleanup: When the IdP rejects an expired refresh token (invalid_grant), the gateway immediately clears the nocr_refresh cookie to prevent repeated futile round-trips.
Refresh Token Rotation Safety: Added singleflight deduplication to performTokenRefresh — concurrent requests for the same refresh token share a single IdP round-trip, preventing race conditions with strict refresh token rotation.