nodePass 0.1.7

Fixed

• Setup requests now time out after 60 seconds per HTTP exchange with guidance to check the installation state before retrying. Long-running import and takeover jobs continue on the server.
• An app process waiting for setup detects when another process has initialized its database, blocks application access and requests a restart instead of offering setup again. Concurrent local setup requests are rejected while a setup operation is active.
• Setup jobs log their start, progress and completion with a shared diagnostic reference without exposing uploaded data, credentials or job tokens.
• TOTP sign-in explains the active method and presents recovery codes as a smaller emergency option below the main actions. Switching methods clears the input and focuses the code field; the new text is translated into all 14 supported languages.
• Add spacing between the sysPass XML import hint and the preview button.

Upgrade notes

• No database schema change is introduced. Preserve existing deployment keys, secrets, persistent volumes and backups, and run a single application process.
• If setup reports SETUP_STATE_CHANGED, stop duplicate app instances and restart the intended application with the existing database, data volume and secrets. A browser timeout does not cancel a server-side setup job.
• The cumulative security catalogue retains NP-2026-001 and NP-2026-002; this release adds no newly disclosed security corrections.

Verified artifacts

• Source commit: 4b95f481862d2f5046815b7d5c3c41db38dce2d6
• Container: ghcr.io/sapientorius/nodepass@sha256:ea9b110cdd67a33fe60d81d54f04b2118f5611392a754158bd036ce8fcde7c98
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.6

Fixed

• sysPass XML imports verify the original export's signed encrypted-node hash and accept separate export and original master passwords. The import form explains both passwords in all 14 supported languages.
• Incorrect import passwords and damaged encrypted data return actionable validation errors instead of a generic server error. Correcting an error and retrying clears the previous message; successful previews clear uploaded XML and password fields.
• Added interoperability regressions using original upstream sysPass XML fixtures, including preview, atomic import, rejected-input cleanup and one-time import challenges.

Compatibility and upgrade notes

• Existing nodePass XML exports remain importable, including the earlier authenticated hash format. New exports use the original sysPass hash convention. Unencrypted sysPass XML still requires the original master password for encrypted account passwords.
• No database schema change is introduced. Preserve existing secrets, persistent volumes and historical backup keys, and update using the release's verified image digest.
• The cumulative security catalogue retains NP-2026-001 and NP-2026-002 from version 0.1.3; this release adds no new advisory identifiers.

Verified artifacts

• Source commit: 2e53f74fd57cb7fa4c8ba0a16633f0fefd76fb8b
• Container: ghcr.io/sapientorius/nodepass@sha256:93b932490011a3fa947661fed2c406931729b167ea324528a313b024c92f39ca
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.5

Added

• A dedicated Backups page lists, creates, downloads and deletes backup files, with background progress and persistent status. Application administrators can configure automatic backups with timezone-aware scheduling, bounded retries and retention of verified automatic versions.
• Application administrators can restore a listed or uploaded nodePass backup after full validation, explicit database confirmation and renewed identity confirmation. Restore creates a verified safety backup, enters maintenance, revokes sessions and recovers interrupted replacements on startup.
• Group and permission-profile member dialogs provide paginated user lists. Group membership can be filtered by primary or additional membership, and administration tables support sorting.

Changed

• Identity confirmation offers clearer passkey, authenticator and recovery-code choices while preserving pending actions.
• Event logs resolve user login names and show translated event descriptions. Backup, restore, membership and confirmation workflows have expanded browser and database regression coverage.

Fixed

• Page headings wrap their actions on narrow screens so longer translated administration titles do not overflow the viewport.

Compatibility and upgrade notes

• No database schema change is introduced. Preserve existing secrets, persistent volumes and historical backup keys, and update using the release's verified image digest.
• Automatic backups remain disabled until explicitly configured. Retention applies only to verified automatic backups; manual, safety and unclassified backups are preserved.
• Web restore requires the backup's original deployment key, sufficient protected working space and exclusive database access through one application process. Restored users, credentials, permissions and factors replace the current ones; automatic backups must be reviewed and re-enabled afterward. See backup and restore operation.
• The cumulative security catalogue retains NP-2026-001 and NP-2026-002 from version 0.1.3; this release adds no new advisory identifiers.

Verified artifacts

• Source commit: 150d0d2405bfa3f87627f026f15669f4379c56d9
• Container: ghcr.io/sapientorius/nodepass@sha256:3e9e8335a200785152571916fe2a6e70382b70983bb5e26c551ec76640b680f2
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.4

Added

• Sensitive actions can request identity confirmation with a registered passkey, TOTP or recovery code, or a password when no second factor is registered. Pending forms are preserved for an explicit retry after confirmation.
• Permission profiles show translated descriptions, and user management explains which users can be edited or have their passwords reset.
• Expanded browser and database regression coverage for identity confirmation, session changes and delegated user management.

Changed

• Ordinary user metadata, group and profile edits preserve browser sessions. Authorization uses current database permissions on every request, and the interface clears open views, displayed secrets and unsaved changes when access changes. Password resets, disabling a user and effective administrator-role changes revoke that user's browser sessions.
• Delegated password resets require both user-management and password-reset permissions. Sensitive user and profile changes require recent identity confirmation; management writes recheck authorization inside a shared transaction lock and record explicit role-change and password-reset audit events.
• Required multi-factor authentication opens the verification or enrollment flow without automatically repeating the denied action. Upgrade documentation now covers existing Coolify, Dokploy and Compose installations.

Compatibility and upgrade notes

• No database schema change is introduced. Preserve existing secrets, persistent volumes and historical backup keys, and use the release's verified image digest when updating.
• Review delegated user-manager profiles: a missing password-reset permission denies resets, including for imported sysPass profiles. Application administrators retain reset access. Ordinary metadata edits do not require renewed identity confirmation.
• The cumulative security catalogue retains NP-2026-001 and NP-2026-002 from version 0.1.3; this release adds no new advisory identifiers.

Verified artifacts

• Source commit: 8875c2d90b15d977ce2168a7cd1520abfee0c8b9
• Container: ghcr.io/sapientorius/nodepass@sha256:4d08c5d930bb53b8b6d494a7207dc17ee56c0f35f6ac1aaf2ec1d0da67800e5b
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.3

Added

• The account overview has an Only me filter for the current user's private accounts. It works with search, categories, customers, tags, favorites and both account views, with filtering applied before totals and pagination.
• Application administrators can inspect and change secondary-group access under Security → Account access, with translated guidance in all 14 supported languages. Changes require recent authentication and are audited.

Security

• NP-2026-001: Group-private accounts now require membership through the user's primary group, including for administrators. Additional group memberships no longer override this privacy boundary. New and edited group-private accounts must use the acting user's primary group.
• NP-2026-002: Password history now enforces each historical record's original owner, group and privacy restrictions in addition to current account permissions. Unauthorized history entries are excluded before the result limit and cannot be revealed or restored.
• Both corrections affect releases from 0.1.0-rc.1 through 0.1.2; release-security.json records 0.1.3 as the fixed version for update notifications.

Fixed

• Account list permissions and direct account access use consistent capability and privacy checks before counting and pagination.

Compatibility and upgrade notes

• Existing secrets, persistent volumes and database schema are preserved. Back up the database and required historical keys before updating to the release's verified image digest.
• Access through secondary groups may become more restrictive for group-private accounts and historical records. Review the account permission rules when upgrading.
• The migrated sysPass accountFullGroupAccess setting remains effective and can now be managed in the interface. It expands explicit group grants for non-private accounts only; privacy and profile permissions still apply.

Verified artifacts

• Source commit: f2cbbec590fa4bab79e06229a5680cae1ab98cfc
• Container: ghcr.io/sapientorius/nodepass@sha256:5d92a07fb2e736ed8c9befe54c3eff85089435ae0f3991921e1c38af49ee4cee
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.2

Fixed

• Coolify and Dokploy repository templates now pull a verified published image instead of requiring a local Dockerfile. Pasting the Coolify definition into a Docker Compose Empty Service no longer fails with failed to read dockerfile: open Dockerfile: no such file or directory.
• Intentional source builds use the explicit docker-compose.build.yml override from a real repository checkout.
• Deployment checks reject accidental source-build requirements in platform templates, and installation instructions distinguish pasted Services from Git-based builds.

Compatibility and upgrade notes

• Use docker-compose.coolify.yml or the Dokploy import from this release's deployment archive to deploy the exact 0.1.2 image. The archive pins the image produced and verified by this release's workflow.
• When fixing an existing Coolify Service, preserve its environment values, service names and persistent volumes. Remove the old app.build block and use the release image instead; no secret regeneration or database reset is required.
• No database schema change is introduced. Preserve deployment keys, setup tokens and database credentials across updates.
• release-security.json records no publicly disclosed security corrections for this release; no independent security audit is claimed.

Verified artifacts

• Source commit: 310f1a0bc8e0249bfa502d99cff5e0f5e35486c2
• Container: ghcr.io/sapientorius/nodepass@sha256:b23fb1b2f0382b8e051b9099ffd07fe12ef16b284d844e90b9e8ef93f4008880
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.1

Changed

• Trusted reverse proxies can be configured by DNS name as well as IP address or CIDR. Names are resolved for incoming forwarded requests, allowing first deployment and proxy IP changes without manually discovering container addresses. Missing DNS denies forwarded requests without preventing application startup; HTTP and signed SSO retain the immediate-peer check.
• Coolify deployments default to the named coolify-proxy ingress and use Coolify's persistent generators for the 32-byte Base64 deployment key, setup token and independent application/root database passwords.
• Dokploy deployments default to dokploy-traefik. A cryptographic secret-generation template and digest-pinned Base64 import are included in deployment bundles; source checkouts can generate an import with npm run deploy:dokploy.
• Installation and operating instructions explain platform networking, generated-secret persistence and safe upgrades of existing installations.

Compatibility and upgrade notes

• Preserve all existing secrets and volumes. Before adopting the new Coolify template, copy the existing deployment key, setup token and database passwords into their corresponding SERVICE_* variables as described in Installation. Do not replace them with newly generated values.
• Dokploy's template import is for new installations only: reimporting generates new secrets. For updates, retain the saved environment and volumes and change the verified image reference.
• No database schema change is introduced by these deployment improvements. Use one application process, the release's verified image digest and the existing backup/restore procedures.
• This release records no publicly disclosed security corrections in release-security.json; this is not a security certification or independent audit.

Verified artifacts

• Source commit: 203508aed76c76665adaf015170d7518fdc34c33
• Container: ghcr.io/sapientorius/nodepass@sha256:7c46890b22fca008816e307b4f3b0d5c76cd2ba5e4921ef98e156b42a9bf94a1
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.0

Added

• First stable nodePass release, promoting the initial release candidate with the changes below.
• Hourly server-side release checks, cumulative security-fix metadata, administrator update notices and deduplicated SMTP notifications.
• Application-administrator version overview with manifest-verified release history and safe Markdown display.
• User-management sign-in controls and validation feedback, plus success notifications after saving changes across account and administration views.

Compatibility and upgrade notes

• Node.js 24; MariaDB 10.11, 11.4 and 11.8; MySQL 8.4. Published application images target Linux amd64.
• sysPass compatibility targets 3.2.11, schema 310.19042701. Preserve the original configuration, master password and pre-migration backup, and stop sysPass writers before takeover.
• Migration changes stored data and encryption state. Returning to sysPass requires restoring the original backup into a separate database; replacing the application image does not undo migration.
• Existing nodePass installations must preserve their deployment key, secrets and volumes. Back up the database and required historical keys and rehearse authenticated restore before updating to the release's verified image digest.
• One application process per installation is supported. Validate the actual dataset, proxy and integration settings before production use. No independent external security audit is claimed.
• This release records no publicly disclosed security corrections in release-security.json; this is not a security certification.

Verified artifacts

• Source commit: d304a94efe77d780c8278a72beeb7a1508fcfb31
• Container: ghcr.io/sapientorius/nodepass@sha256:b14c608e4f243672a90f630190f312939b74be2599313577361a4b19d592b693
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

nodePass 0.1.0-rc.1

Added

• Initial nodePass release candidate: FeathersJS API, Vue interface, passkeys, integrated TOTP, permission-controlled password management and a one-time sysPass migration path.
• GitHub verification gates, version checks, digest-pinned release deployment bundles, container SBOMs and release provenance.

Compatibility and upgrade notes

• Node.js 24; MariaDB 10.11, 11.4 and 11.8; MySQL 8.4. Published application images initially target Linux amd64.
• sysPass compatibility targets 3.2.11, schema 310.19042701. Preserve the original configuration, master password and pre-migration backup. Stop sysPass writers before takeover.
• Returning to sysPass requires restoring the original backup into a separate database. Changing the application image alone does not undo migration.
• One application process per installation is supported. Validate actual proxy and integration settings and rehearse authenticated restore before using a real dataset.
• No independent external security audit is claimed.

Verified artifacts

• Source commit: a8f3ca6c03e44d6f63df11aa57649f243094968f
• Container: ghcr.io/sapientorius/nodepass@sha256:971ec905aad3529b810db4c4d5c776e1c892129c639d9c171ce9a1ce429782a5
• Platform: Linux amd64
• Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.