Coop 1.0.2

[cassidyjames]

This release addresses reported security advisories, improves NCMEC CyberTipline reporting, and includes front-end quality-of-life improvements.

Security

Note

For security announcements, we encourage adopters to subscribe to the security-announce@roost.tools mailing list.

• Routine dependency package upgrades to address vulnerabilities
• See Security and quality for published security advisories

NCMEC

• Added email as a supported schema field role for user items, ensuring inclusion and validation for NCMEC reports (ncmec: add email schema field role for reported user (closes #839) #840, ncmec: tighten email field role from STRING to EMAIL_ADDRESS scalar #842)
• EMAIL_ADDRESS added as a first-class scalar in @roostorg/coop-types (v2.4.0) (Add EMAIL_ADDRESS scalar to @roostorg/coop-types (v2.4.0) #841)
• Auto-populate originalFileName (from the media URL) and fileRelevance (defaults to Reported) for NCMEC reports (ncmec: auto-populate priorCTReports, originalFileName, fileRelevance #855)
• Fixed fileDetails.ipCaptureEvent XSD element ordering (ncmec: fileDetails.ipCaptureEvent emitted in wrong XSD position causing /fileinfo rejection #856)

Review Console

• Added User Strikes count to job and item investigation views (User Strikes: Add to Review Console jobs and item investigation view #766)
• Added decision reasons to recent decisions view and CSV exports ([Feature] Add decision reason to recent decision view as well as csv download #772)
• Split "require decision reason" into separate action and ignore settings ((manual review) Split require-decision-reason into action vs ignore settings (#757) #780)
• Fixed duplicate entries in recent decisions ([Bug] Fix duplicate recent decisions on select latest #774)
• Empty threads are no longer hidden (fix: don't hide empty threads #804)
• Improved Review Console dashboard display by ellipsizing long queue IDs (client: truncate queue ID column in ManualReviewQueuesDashboard (closes #662) #849)
• Improved moderator textarea placeholder for clarity (fix: replace actorNote developer identifier in moderator textarea placeholders #711)
• Fixed content URL rendering in the review iframe when no content proxy is configured (manual review: fix iframe rendering when no content proxy is set #777)

Actions

• Parameterized actions now work with proactive rules and user strikes (Extend parameterized actions to proactive rules and user strikes #792)
• New per-queue "clear other reports for a user" sweep action; sweep now also handles related items (Add per-queue "clear other reports for a user" action sweep #817, [Fix] Ensure sweep also handles related items #835)
• Added creator field to action webhook callbacks ([Feature] Include creator in action webhook callback #755)

Investigations

• Added IP address lookup to investigation view ([591][Feature] Add IP address lookups for investigations #754)

Other fixes

• Added client-side email validation for invites (client: Validate email address format for invites #786)
• Express session store now properly closed on API shutdown (fix: close express-session store on api shutdown #825)

CI & infrastructure

• Server integration tests now run in CI (ci: run server integration tests in CI #827); basic Playwright E2E test suite added (tests: set up basic playwright E2E test #823)
• Server tests isolated via transaction rollback (test: isolate server tests via transaction rollback #732)
• TypeScript type-checking added for db and migrator in CI (ci: typecheck db and migrator in CI #782)
• Prettier enforced globally in CI (Apply prettier globally and enforce it in CI #834)
• GitHub Actions updated to Node 24 runtime (ci: update all GitHub Actions to Node 24 runtime #795)
• zizmor added to lint CI workflows for security issues (ci: use zizmor to lint for CI security issues #721)
• Knip added across all packages to remove unused dependencies (Setup Knip & remove unused server dependencies #734, client: set up knip and remove unused dependencies #760, db: set up knip and remove unused dependencies #761, migrator: set up knip #762)
• Redis user/password now correctly set in no-cluster mode (Set redis user and pw in no-cluster mode #747)

New contributors

• @reitblatt made their first contribution in [Easy] Add missing @parcel/watcher dev dependency #785
• @jess-upscrolled made their first contribution in fix: don't hide empty threads #804
• @ltianyi992 made their first contribution in fix: replace actorNote developer identifier in moderator textarea placeholders #711

Full Changelog: 1.0.1...1.0.2

---

This discussion was created from the release Coop 1.0.2.