Release 6.48.0

Poznote 6.48.0

⚠️ This is an important security update, upgrading is strongly recommended.
📝 When upgrading, remember to review your .env file against the new .env.template, which documents new options.

It focuses on making passwords and SSO work together in a clear and safe way.

New features

🔑 Know which password you're actually using
The Change Password modal and the admin Users panel now show your password status: custom password (with the last change date), default password, or SSO-only profile with no password at all.

🛡️ SSO-provisioned profiles no longer answer to the default password
Profiles auto-created through OIDC now have no password at all instead of silently accepting the instance default. Sign-in goes through your identity provider, and an admin can still set an explicit password from Settings > Admin Tools > Users.

🔒 A single, honest switch for SSO-only mode
POZNOTE_OIDC_DISABLE_NORMAL_LOGIN=true is now the only switch that disables password login: it removes the form, rejects password submissions server-side and hides the Change Password setting. The old "hide the login form" preference and its invisible corner button are gone. The README explains how to recover if your identity provider goes down.

🌍 Login page in your browser's language
The login page now picks its language automatically from your browser instead of showing a language selector.

Improvements and fixes

• 🔐 Legacy "remember me" cookies from before the multi-user era are no longer accepted (weak signature). You may have to log in once again.
• 🔐 Remember-me tokens with a tampered or future-dated timestamp are now rejected.
• 🧑‍💼 Resetting the password of an SSO-linked profile now explains that there is no default password to fall back on.
• ⚙️ The .env template now documents the MCP server port and the debug flag.

As always, thank you for your feedback and support! If you enjoy Poznote, you can support its development on Ko-fi. ❤️