Skip to content

v1.14.0

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 01 Jul 22:47
v1.14.0
f2d7ecb

Security

  • Whole-product security review + remediation (see
    docs/audits/security-review-2026-07-02.md; tracked in docs/security.md).
    A six-surface review plus govulncheck found and fixed 4 high, 8 medium, and
    6 low findings; govulncheck reachable advisories went 28 → 0.
    • Org server access control (high). Three privileged /api/org/* routes
      (routing-policy publish, routing-summaries export, enrolment-token mint)
      were gated on SAML-session presence only, so any SSO-capable member could
      reach them — publish a fleet-wide routing policy, export every developer's
      email and spend, or mint an enrolment token for an arbitrary user (ingest
      impersonation). They now require org-admin authority (admin_emails).
    • SAML signature bypass (high). Bumped goxmldsig 1.4.0 → 1.6.0
      (GO-2026-4753, reachable from assertion validation), golang.org/x/net
      0.53 → 0.55, and the build toolchain to go1.25.11 (clears ~25 stdlib
      advisories including html/template XSS reachable from the org dashboard).
    • Dashboard CSRF / DNS-rebinding (high). The local dashboard exposed
      state-changing endpoints with no origin or Host validation; a malicious web
      page could drive them. Added a same-origin + loopback-Host guard and a
      non-loopback-bind warning.
    • Watcher symlink escape (high). A symlink planted under a watch root
      could be followed out of the tree and its contents excerpted into the DB;
      such symlinks are now skipped.
    • Privacy / attribution (medium). Ingested user_email is pinned to the
      authenticated pusher (was forgeable on aggregate rows), and git_branch is
      no longer shipped in the default metadata-only sharing posture.
    • Denial-of-service hardening (medium/low). Enforced the previously-dead
      [watcher].max_file_size_mb, added watcher panic recovery, a protobuf
      recursion-depth cap, and a proxy request-body size cap; plus a proxy
      guard-mask JSON backstop, WSL hook-command quoting, git gitdir: traversal
      rejection, and PowerShell path escaping.

Added

  • Config auto-migration rail. Deprecated config keys are now rewritten
    to their current names on disk instead of only being mapped in memory (which
    reprinted a config: deprecation: warning on every load). A new pure,
    table-driven registry (internal/config/migrate) surgically renames keys —
    preserving your values, comments, ordering, and every untouched section —
    drops keys with no analog, and stamps [observer] config_version. It runs
    automatically once on observer start (the daemon is the sole writer; a
    config.toml.bak backup is written first) and on demand via observer config migrate / observer config migrate --dry-run. Idempotent and
    fail-safe: a value it can't edit by line surgery is left untouched, never
    corrupted. Registry v1 migrates the decommissioned [compression.code_graph]
    / [intelligence.code_graph] blocks onto [codeintel].

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Linux x86_64 observer-v1.14.0-linux-x64.tar.gz
Linux arm64 observer-v1.14.0-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.14.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.14.0-darwin-arm64.tar.gz
Windows x86_64 observer-v1.14.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.14.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.14.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.14.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.14.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 16
Loading