Skip to content

openRun 0.2.0

Choose a tag to compare

View all tags
@stretch0 stretch0 released this 30 Oct 21:01
· 5 commits to main since this release
v0.2.0
e729205
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Try it without installing anything: openrun-demo.fly.dev signs you in as Sam, a runner in a run club. It resets every night.

New

  • Club logos. Organisers can upload a logo and pick the square to keep, or fit the whole image. Clubs without one get a logo generated from their initials.
  • Light or dark mode. Choose in Settings → This device, or keep following the device.
  • A new look. The brand colour is now teal.
  • Demo mode. DEMO_MODE=true turns an instance into a public demo: sample data, a shared login, and a reset every night. It replaces everything in the database, so never use it on a real instance. See docs/DEMO.md.

Security

  • Updated dependencies with known vulnerabilities, including sharp (image handling, with its bundled libvips) and React Router (an open redirect in links).

  • The Docker image no longer contains npm, corepack or Yarn. Nothing used them at runtime, and they made up most of the image's vulnerability reports.

  • Node base images are pinned by digest, and every GitHub Action by commit.

  • Images on GHCR carry signed build provenance, and each release includes a signed source archive. To check an image:

    gh attestation verify oci://ghcr.io/stretch0/openrun:0.2.0 -R stretch0/openRun

  • CodeQL, dependency review, Trivy image scans and OpenSSF Scorecard run on every change. Vulnerabilities can be reported privately.

Upgrading

Back up first (how), then:

docker compose pull
docker compose up -d

One database update (club logos) is applied when openRun starts. If you pinned the release line in docker-compose.yml, change ghcr.io/stretch0/openrun:0.1 to :0.2.

Assets 4
Loading