Skip to content

Fulla v1.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Aug 16:14
· 112 commits to master since this release
v1.0.1
136a3da

[1.0.1] - 2026-08-30

License

  • License change: MIT -> AGPL-3.0. Starting with this version the project
    is licensed under the GNU Affero General Public License v3.0; the v1.0.0
    release remains MIT. The core stays fully open source — individuals,
    study, self-hosting and internal use are unaffected. Vendors offering the
    software (modified or not) as a hosted service must release their
    modifications per AGPL-3.0 §13, or obtain a commercial license
    (open-core: enterprise features are distributed separately). A CLA is
    required for contributions so the project can keep dual-licensing.

Added

  • oauth2: VerifyJwt follow-ups — expectedAud, nbf, strict base64url, verifyAndDecode, ephemeral kid (#87)
  • config: Production gates for signing key and weak client secrets (#102)
  • identity: Unlink guard counts WebAuthn credentials + post-delete race recheck (#73)
  • social: Disable providers with empty/placeholder credentials (#111)
  • social: Server-side one-time link state, closing provider-code injection (#71)
  • ops: Schedule ensure_audit_partitions() on the cleanup cycle (#83)
  • security: Consent authentication gates + admin bootstrap + password policy (IAM hardening tranche 1)

Fixed

  • tests: Repoint FULLA_DOC_API_REFERENCE to docs/domains/ after IA restructure
  • docs: Keep error-table message strings catalog-exact in the EN api-reference
  • website: Localize sidebar/navbar/footer via official i18n files; categorize ADRs
  • oidc: End_session array-aud candidates + enveloped 400s (#88 items 1-2)
  • logout: Backchannel notifier matches both user_id subject forms (#82)
  • CI regressions from batch-1 (WERROR getenv, fallback guard scope, N2 wait, doc table, ignore wording)
  • tests: OAuth2Tests fail-fast 0xc0000409 — three causes, all test-side
  • ci: Ratify RateLimiter.getConfig() in api-diff baseline; exact-prefix oasdiff ignore line
  • ci,docs: Coverage workflow drogon_ctl PATH, API/deployment docs sync (#105, #112)
  • ci: Sanitizer link flags PUBLIC; memory-mode-safe partition test guard
  • mfa: Base32 bit-accumulation overflow (UB) found by the first UBSan run (#104)
  • ci,ubsan: TotpUtils drogon-lib UB + Redis AUTH in sanitizer/coverage workflows
  • ci,asan: Ubuntu 24.04 + RateLimiter UAF + coverage div-zero guard
  • benchmarks: GC jitter root cause analysis — WSL2 I/O scheduling pauses, not runtime GC
  • ubsan,werror: Base64UrlDecode shift UB + GCC 13 redundant-move
  • docker: Add WeChat env override, FULLA_VERSION, and consistency comments
  • config: Add /oauth2/device/approve rbac rule in all five configs
  • admin: Complete MFA login, device approval page, dashboard/log/user honesty fixes
  • user: WebAuthn register contract, real logout, consent user_id, backup codes
  • frontends: Consume MFA PKCE verifier on success, not on entry
  • frontends: Address PR #140 review — logout self-revoke race, mock envelopes, RT retention
  • tests: Drop unused constants breaking -Wunused-const-variable on clang
  • config: Move new auth knobs under custom_config.auth (repo convention)
  • review: Consent_csrf into OpenAPI contract, admin-api password floor, bootstrap self-heal, review cleanups

Documentation

  • readme: Capability map + module map, bilingual
  • readme: Fix zh anchor to the actual SDK layering heading
  • Documentation governance design v1 — triage of docs/ + Docusaurus content sourcing
  • governance: V2 — content-level verdicts from full-text deep review
  • governance: Phase A part 1 — contradiction fixes + triage execution
  • governance: Phase A part 2 — six merges, 12 ADRs, audience navigation
  • governance: Re-execute the history/locals untrack that git add -A had reverted
  • governance: Phase B — Docusaurus site skeleton, zero-copy docs/ sourcing
  • governance: User-only docs tree + IA-shaped restructure (review follow-up)
  • Pre-launch content quality pass (audit P0/P1 fixes)
  • api-reference: Unified simplified Chinese + OpenAPI governance flow
  • adr: Bring the three governance trust archives into the repo
  • Repoint root-facing doc links to the new IA + link fulla.dev
  • Phase C deep-dives + English-primary bilingual site (en + zh-CN)
  • Bilingual follow-up — zh README links to the zh-CN site, dual-write rule in CONTRIBUTING, changelog entry
  • P2 cleanup — ship the verification script, linkify ADR references
  • reports: Add runtime verification for Docker port binding (#112)
  • repo: Add nested AGENTS.md guides for libs/drogon, libs/storage-postgres, apps/server
  • deploy: Fix bootstrap flow, prod seed steps, TLS cert order

Testing

  • Rerun-safe DB seeds in integration tests (#72)
  • Event-driven Redis cache-fill waits replace fixed sleeps (#90)
  • admin: LastAdminGuard self-heals its sole-admin premise (#72)
  • admin: LastAdminGuard sweep must DELETE, not repoint (#72 follow-up)
  • naming: Rename consent gate tests to convention; clean probe

CI/Build

  • frontend: Add production builds to the fast frontend gate
  • frontend: Add production builds to the fast frontend gate
  • SHA-pin all workflow actions + dependabot.yml (#107)
  • Sanitizer gates (ASan+UBSan PR leg, nightly TSan) + UBSan support (#104)
  • frontend: Strict tsc, lint gate, e2e in CI — closing the frontend quality gap (#108)
  • sanitizer: Prepend drogon_ctl's Conan bin dir to PATH (port of the coverage fix)
  • deps: Bump anchore/sbom-action/download-syft
  • deps: Bump actions/setup-go from 5.6.0 to 7.0.0
  • deps: Bump actions/upload-pages-artifact from 3.0.1 to 5.0.0
  • deps: Bump sigstore/cosign-installer from 3.9.2 to 4.1.2
  • deps: Bump actions/cache from 4.3.0 to 6.1.0

Miscellaneous

  • community: Issue templates (bug / feature forms) + contact links
  • deploy: Loopback-bind dev compose data ports + credential warnings (#112)
  • sdk: Regenerate python/go clients from the #71 link-state spec
  • deps-admin: Bump the admin-frontend-minor group
  • deps-user: Bump the user-frontend-minor group
  • deps-admin: Bump pinia from 3.0.4 to 4.0.3 in /frontends/admin
  • deps-admin: Bump globals in /frontends/admin
  • deps-user: Bump pinia from 2.3.1 to 4.0.3 in /frontends/user
  • deps-user: Bump globals in /frontends/user
  • deps-admin: Bump eslint-plugin-vue in /frontends/admin
  • deps-user: Bump vue-tsc from 2.2.12 to 3.3.11 in /frontends/user
  • api-diff: Ratify WeChat env override additions (follow-up to #139)
  • gates: Ratify additive api-diff (RuleSet policy + AuthService legacy gate); oasdiff errata for register password minLength
  • gates: Oasdiff errata entry on one line for text matching
  • Untrack local qoder diff artifacts (not for the repo)
  • Ignore qoder diff artifacts
  • gates: Oasdiff errata — consent_csrf required param is the security fix itself

Other

  • Create CNAME
  • Professional landing page, brand theme, Chinese locale, local search

Verification

Images are signed with cosign (keyless, GitHub OIDC):

cosign verify ghcr.io/voidvec/fulla-backend:1.0.1 \
  --certificate-identity-regexp 'https://github.com/voidvec/fulla/.github/workflows/release.yml.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

SPDX SBOMs for the three images and the source tree are attached,
as is the SDK tarball checksum:

sha256sum -c fulla-sdk-1.0.1-linux-x86_64.tar.gz.sha256
Assets 8
Loading