Repository navigation
Configra v1.2.1 fixes cross-environment Config copies, credential setup and actionable error reporting. All binaries use Go 1.26.9; the Kubernetes component also updates x/net to v0.60.0 to address reachable HTTP/2 vulnerabilities.
本版修复 test → production 的同名 Config 首次复制、含糊的错误、日期有效期和 CA 标识复制体验。从 v1.2.0 升级无需数据库结构迁移，schema 保持 4；configra-go 继续使用 v1.2.0。
Fixes
- Copy to environment / 复制到环境 creates the first target version while retaining the Config key. Existing targets are protected by revision checks. Clone continues to create a globally new key and now explains name collisions.
- Saved source revisions are pinned. Network retries retain Operation IDs, failed operations keep safe reasons, and completed transfers can replay after archival. Restore waits for the complete snapshot before another copy; format-only changes create a new revision.
- Errors show concrete guidance plus copyable Request/Operation IDs. Parser text and secret values are excluded from errors and audits.
- Credential dates show elapsed lifetime and policy overruns. Expired Tokens display correctly. CA IDs, full fingerprints and issuer/Token identifiers are visible and copyable, with explicit clipboard feedback.
- Machine reads reuse eight fixed SQL statement plans. Authorization and resource results remain uncached; Config/File reads retain read-only repeatable-read snapshots.
- The frontend build dependency
source-map-jsmoves to 1.2.2 for CVE-2026-93749; CI now rejects high/critical npm advisories. The npm audit reports zero findings. - Go runtime and Kubernetes HTTP/2 security updates retain strict module, runtime-license, source/SBOM and artifact checks. Kubernetes source builds require Go 1.26.9; the downloaded executable requires no installed Go compiler. SDK APIs and CRDs are unchanged.
Upgrade
Download the archive for your platform and verify SHA256SUMS. Each archive contains configra, configractl and configra-kubernetes for macOS/Linux, amd64/arm64.
Drain writers, replace/restart the matching services, check doctor and a real mTLS read, then reload the Management UI. Do not reinitialize the database. For upgrades from v1.1.0 or v1.0.1, follow the earlier schema migration instructions linked in the runbook.
Patch upgrade and rollback · Config copy guide
Verification
Source commit: f62ad6be808add905d1d2c6e36263158dbe8f319.
- Normal CI: Go/race/vet/module checks, vulnerability gates, Web and actual service integration.
- Release acceptance: real MySQL/NATS/ClickHouse, ten-minute capacity/leakage gate and three-node Kubernetes recovery/rotation.
- All 78 browser cases pass. Final four-platform bundles pass checksum, composition, target/toolchain, SDK and source/SBOM binding checks. All 20 SBOMs validate against CycloneDX 1.6; the three native macOS/arm64 executables report v1.2.1 and the exact source commit.
- Final hosted actual-image capacity: 600,000 requests over ten minutes, zero errors, 999.97 completed requests/s, p95 312.86 ms; all 615,002 access events captured/persisted and leak scans passed.
- Final local actual-image capacity: 600,000 measured requests over ten minutes, zero errors, 999.99 completed requests/s, p95 36.72 ms; all 615,002 expected access events captured/persisted and leak scans passed.
- Tag-triggered release build passed. All five downloaded assets were independently rechecked before publication, including archive checksums, exact source identity, all 20 SBOM schemas and native executable versions. Verification record.
Earlier capacity failures and the subsequent SQL-preparation optimization are retained in the verification record; capacity thresholds were not relaxed.
Publication does not update or restart your production deployment automatically.