Skip to content

nodePass 0.1.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Oct 10:37
Immutable release. Only release title and notes can be modified.
nodepass-v0.1.4
8875c2d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Sensitive actions can request identity confirmation with a registered passkey, TOTP or recovery code, or a password when no second factor is registered. Pending forms are preserved for an explicit retry after confirmation.
  • Permission profiles show translated descriptions, and user management explains which users can be edited or have their passwords reset.
  • Expanded browser and database regression coverage for identity confirmation, session changes and delegated user management.

Changed

  • Ordinary user metadata, group and profile edits preserve browser sessions. Authorization uses current database permissions on every request, and the interface clears open views, displayed secrets and unsaved changes when access changes. Password resets, disabling a user and effective administrator-role changes revoke that user's browser sessions.
  • Delegated password resets require both user-management and password-reset permissions. Sensitive user and profile changes require recent identity confirmation; management writes recheck authorization inside a shared transaction lock and record explicit role-change and password-reset audit events.
  • Required multi-factor authentication opens the verification or enrollment flow without automatically repeating the denied action. Upgrade documentation now covers existing Coolify, Dokploy and Compose installations.

Compatibility and upgrade notes

  • No database schema change is introduced. Preserve existing secrets, persistent volumes and historical backup keys, and use the release's verified image digest when updating.
  • Review delegated user-manager profiles: a missing password-reset permission denies resets, including for imported sysPass profiles. Application administrators retain reset access. Ordinary metadata edits do not require renewed identity confirmation.
  • The cumulative security catalogue retains NP-2026-001 and NP-2026-002 from version 0.1.3; this release adds no new advisory identifiers.

Verified artifacts

  • Source commit: 8875c2d90b15d977ce2168a7cd1520abfee0c8b9
  • Container: ghcr.io/sapientorius/nodepass@sha256:4d08c5d930bb53b8b6d494a7207dc17ee56c0f35f6ac1aaf2ec1d0da67800e5b
  • Platform: Linux amd64
  • Complete verification run

Verify SHA256SUMS and the release attestations before installation. The deployment bundle contains Compose files pinned to this image digest.

Assets 7
Loading