v0.23.0-rc4

Release Notes

Three changes shipped in this release: a configuration improvement for OAuth2, a frontend positioning fix, and a backend upgrade-stability improvement.

---

New Features

• Configurable OAuth2 scopes — Operators can now customize which scopes are requested during login. The default (openid email profile offline_access) is unchanged, but providers like Google that don't support offline_access can now be configured without patching. See the updated configuration docs for examples.

---

Bug Fixes

• Combobox dropdown positioning in modals — Dropdown menus (e.g. the Owner and Access class fields in the Deploy dialog) were rendering in the wrong position when opened inside a modal. Fixed by always portaling to document.body, which avoids the CSS containing-block issue caused by the modal's backdrop-filter.

---

Other Notable Changes

• Gradual CRD backfill on upgrade — RiseProject CRDs are now stamped with a rise.dev/version label. On upgrade, the label change triggers an immediate Metacontroller resync per project without relying on polling intervals. Backfill runs as a background task (HTTP server starts immediately) and is rate-limited via the new crd_upsert_interval_ms setting (default: 1000 ms) to avoid API bursts on large installs.

---

Download rise-deploy 0.23.0-rc4

File	Platform	Checksum
rise-deploy-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
rise-deploy-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
rise-deploy-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum