v2026.10.13

Changed

• The "all set" page suggests the inviter's profile name when the invite came from ku workspace invite; an invite
  from ku-server user invite (no inviter alias) keeps the <alias> placeholder.

Full Changelog: v2026.10.12...v2026.10.13

v2026.10.12

Added

• ku logout ends the session on the server and forgets it on this machine.

Changed

• The "all set" and server home pages show ku profile add <alias> --url ...: each person picks their own profile
  name. Pasted unchanged the shell rejects the <, and ku profile add refuses <alias> or alias with a hint.

Fixed

• Behind Cloudflare the invite page could still show "[email protected]": the address now also carries a <wbr>
  after the "@", so the obfuscation scanner does not match it (it looks and copies the same).
• Deploy templates (Docker, Dokploy, Coolify) pass VAULT_TRUSTED_PROXIES to the container; before, setting it in the
  platform had no effect.

Full Changelog: v2026.10.11...v2026.10.12

v2026.10.11

Added

• VAULT_TRUSTED_PROXIES (CIDRs, or cloudflare) so the audit log and rate limits see the real client IP behind a CDN
  or load balancer.

Full Changelog: v2026.10.10...v2026.10.11

v2026.10.10

Added

• ku link <app> creates the app when it is new and gives you write access; an existing app still needs an admin's
  grant.

Full Changelog: v2026.10.9...v2026.10.10

v2026.10.9

Fixed

• ku secret commands now use the linked folder's app tag, like ku run; a denied write says which tags and how to
  get access.

Full Changelog: v2026.10.8...v2026.10.9

v2026.10.8

Security

• A CLI sign-in link works once: after the sign-in completes, reopening it shows 'already used' instead of starting
  another sign-in.

Full Changelog: v2026.10.7...v2026.10.8

v2026.10.7

Fixed

• Behind Cloudflare, the invite and sign-in pages showed "[email protected]": addresses are now marked so a CDN's email
  obfuscation leaves them alone (its decoding script is, correctly, blocked by the pages' CSP).
• Docs: deploying behind a cloud load balancer that terminates TLS, and HTTPS behind Cloudflare.

Full Changelog: v2026.10.6...v2026.10.7

v2026.10.6

Added

• A page at / that shows how to connect the CLI; a readable page when a browser reaches the server over plain HTTP.

Fixed

• The image includes a minimal shell (busybox) so platform terminals (Dokploy, Coolify) can run ku-server commands.

Full Changelog: v2026.10.5...v2026.10.6

v2026.10.5

Changed

• Release images build much faster: Go cross-compiles for arm64 instead of running under emulation, with layer caching.

Full Changelog: v2026.10.4...v2026.10.5

v2026.10.4

Security

• golang.org/x/crypto v0.58.0; SECURITY.md explains the one govulncheck advisory that does not apply.
• Website: strict Content-Security-Policy and HSTS.

Added

• Install scripts are tested on macOS, Linux and Windows (PowerShell 7 and 5.1) on every change and weekly.

Fixed

• Deploy templates, checked by running them: render.yaml uses the current plan id 0.5c-512mb and Render's port 10000; the Swarm stack documents the proxy network it requires; the Dokploy and Coolify docs say what the platform leaves to you (HTTPS and VAULT_DOMAIN on Dokploy, a bare domain on Coolify).

Full Changelog: v2026.10.3...v2026.10.4