Skip to content

Coop 1.0.0

Choose a tag to compare

View all tags
@juanmrad juanmrad released this 09 Jun 21:26
1.0.0
5e21eb5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Note

This release re-publishes the Coop 1.0 artifacts under a semver-compliant tag 1.0.0 so the versioned container images publish correctly. It points at the same commit as the original 1.0 release; that release remains unchanged.

We're thrilled to share Coop 1.0! This is our first major release and the one we've been building toward since Coop went open source: ready for self-hosted deployment by platforms of all sizes. Since v0.1, we've focused on three major areas:

  • Making it easier to get started for developers, contributors, and self-hosters including both significant simplification and completely rewritten documentation

  • Expanded features & capability in response to adopters' production usage, including review console features and child safety reporting

  • Reliability & sustainability including several fixes, improvements, and security hardening to ensure Coop is production-ready and well-positioned as a critical open source project

Making it easier to get started

We focused a ton of time and effort on making it faster, easier, and lighter-weight to get up and running with Coop.

Simplification & modernization

Coop 1.0 is dramatically simpler to deploy than earlier versions. We now build and publish Docker images for easier testing and deployment. We migrated from Sequelize to Kysely, making Coop lighter-weight and easier to keep secure with fewer dependencies. We replaced Kafka with BullMQ for item submission processing, removing one of the most operationally demanding deployment dependencies. And we cleaned up a significant amount of SaaS-era code that was never meant for self-hosted deployments, including legacy client marketing and tracking assets, Snowflake, the legacy risk AI model, and other unmaintained remnants.

On the modernization front, we upgraded to Apollo v5, Express 5, and migrated the client build from Create React App to Vite.

Rewritten documentation

Before Coop 1.0, our documentation was a mix of SaaS-oriented content, early architectural notes, and several incomplete attempts to expand coverage. We spent significant time completely reworking it. The README is simpler to skim, and the new docs site structure separates content into four distinct sections: user guide, development and deployment, API reference, and integrations. We also implemented versioning, so docs for main will always live at roostorg.github.io/coop/latest and docs for this release at roostorg.github.io/coop/1.0.

Admin settings

We built out a new granular capability-based permissions system that makes it easier to customize what roles and permissions are available for your team. As a SaaS product, several features for organizations were also hidden behind database-only toggles; to make it easier to customize Coop for your platform and deployment, we've moved these settings directly into the Coop front-end for administrators.

Expanded features & capability

We were extremely fortunate to have multiple platforms adopt Coop during the 1.0 development cycle; this meant we had real-world users sharing invaluable feedback. As a result, Coop 1.0 is now a better product—not just for these adopters, but for everyone. We shipped several significant capabilities as a result:

Review & moderation improvements

  • User Strikes are now enabled, giving platforms a native way to track and act on repeat violations directly within Coop
  • Parameterized actions let moderators pass runtime values when making decisions, making enforcement workflows significantly more flexible
  • "Invalidate reports from a reporter" action is now available in the manual review tool, useful for addressing spam reporting
  • The investigation tool now surfaces users even when no submitted item is available
  • Comments from deleted users are now visible on manual review jobs
  • Policy selection and decision reason requirements are now enforced server-side, closing a gap where those constraints were UI-only
  • Recent actions list refreshes automatically after submitting an action
  • Point of Interest (Google Maps) is gracefully disabled when no API key is configured

Additional platform needs

  • Coop now supports OpenAI's omni-moderation-latest model as an image moderation signal source
  • HMA exchanges can now be configured directly from the Coop UI, removing the need to manage that setup separately
  • IP address is now a first-class schema field role for tagging items with source IP data
  • A new MEDIA content type is supported end to end, from submission through the review console
  • A create-org script is now available for provisioning new organizations from the command line

Child safety improvements

  • Built-in NCMEC enqueue actions are now available to all orgs
  • NCMEC and Review Console enqueue actions now work for users with no prior submission record
  • Added additionalInfo to NCMEC reports and fixed XML element ordering
  • Failed NCMEC submissions now persist and surface with a retry option in the Reports dashboard
  • IP address is now automatically added to NCMEC reports when present
  • NCMEC report routing moved from hardcoded values to environment config
  • Reviewer-friendly error messages now surface for failed NCMEC jobs

Reliability & sustainability

As a critical open source project that empowers platforms to keep their users safe, it's crucial that Coop is reliable, sustainable, and secure. We focused on ensuring Coop 1.0 meets these goals and will continue to meet them going forward.

Fixes

  • Postgres idle-client errors crashes are fixed
  • ClickHouse outages no longer crash dashboard pages
  • Fixed server crashes from transient ClickHouse errors and capped Scylla memory to prevent OOM
  • Review queues can support large bursts of job creation when backfilling or populating queues
  • GraphQL depth limit set and depth-limit crashes resolved
  • Server now fails fast on Redis outage during async item submission rather than hanging
  • Dashboard routes lazy-loaded to prevent cascading failures
  • Fixed the Submit button being cut off when content overflows in MRT and investigation views
  • Fixed CoopButton links not respecting disabled state

Security & dependencies

Note

For security announcements, we encourage adopters to subscribe to the security-announce@roost.tools mailing list.

When we first released Coop's source code, there was a significant amount of dependency debt to address. Coop 1.0 resolves every known critical and high severity alert through a combination of dependency removal and version updates across the entire project. We also hardened our supply chain practices: GitHub Actions are now SHA-pinned with --ignore-scripts, and the Busybox Docker image is pinned by digest to prevent silent substitution. We added automated license scanning to CI to enforce compatibility with Coop's Apache-2.0 license.

This release also addresses two reported security vulnerabilities; see the following advisories for details:

Other improvements

  • End-to-end integration tests added for item submission, report flow, and rule changes
  • CI checks moved into Docker Compose services for consistency with local development
  • Husky pre-commit hooks wired up with lint-staged
  • AGENTS.md added with Coop-specific guidance for AI coding assistants
  • Issue forms added to guide bug reports and feature requests

Get involved

We're building Coop in the open and this release reflects the work of an incredibly active community of contributors, adopters, and testers. Whether you're deploying Coop, hitting a rough edge, or have ideas to explore, please open an issue or join our Discord. Your feedback directly shapes our roadmap.

Thank you!

A huge thank you to everyone who contributed to this release, and a special welcome to our nine new contributors making their first contributions to Coop: @TomHawk123, @dom-notion, @vinaysrao1, @samuelralak, @ThatKoffe, @haileyok, @davidyshin, @ded-furby, and @JagadeeshChandra12, alongside returning contributors @juanmrad, @julietshen, @pawiecz, @cassidyjames, serendipty01, @wayjaywang , and @calebmcquaid. This release is a testament to what an open, collaborative community can build together. Thank you all. 🎉

Full Changelog: 0.1...1.0.0

Assets 2
Loading