Skip to content

v0.7.0

Choose a tag to compare

View all tags
@joaorufino joaorufino released this 25 Jul 16:35
· 179 commits to main since this release
v0.7.0
8eca4f9

Security

  • Sessions and API keys no longer outlive their owner: deleting or deactivating a user immediately stops their existing credentials from authenticating (pk-apps v0.8.0).
  • A user can no longer delete their own account — DELETE /api/v1/users/{id} returns 409 for the caller's own subject (pk-modules v0.9.0).
  • The shipped binary can finally reach production configuration. config.yaml next to the process (or PK_CONFIG=/path/config.yaml) is loaded through LoadConfig, which fails closed to environment: production and therefore requires seed.admin_password. Previously the released binary was permanently development mode with a published, self-re-asserting password — including when bound to a network interface via PK_HTTP_ADDR.

Changed

  • Downstream modules may claim / and /favicon.ico instead of colliding with the starter's landing page.
Assets 2
Loading