Skip to content

16.3.6

Choose a tag to compare

View all tags
@voipnorm voipnorm released this 03 Sep 15:44
v16.3.6
0ff1a69
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CE-Deploy 16.3.6

Version 16.3.6 adds the acquisition-telemetry foundation, strengthens scheduled automation and multiple security boundaries, improves QR output, and fixes Workspace ID CSV filtering and feedback.

Acquisition telemetry foundation

  • Added a privacy-conscious Supabase acquisition telemetry service for measuring installation activity, application version/channel adoption, operating-system family, and aggregate RoomOS endpoint reach.
  • Added a one-time disclosure and Settings controls to enable or disable acquisition telemetry, reset the pseudonymous installation identity, and request deletion of collected installation telemetry.
  • Added endpoint-count observations to existing cloud, on-premises, and Tag Schema discovery workflows. Producers publish only bounded aggregate observations (count, source, and confidence) and do not perform telemetry-only Webex requests.
  • Added a main-process-owned installation identity, encrypted deletion credential, daily heartbeat scheduling, bounded transport, strict IPC bridge, and resilient failure behavior that does not block CE-Deploy workflows.
  • Added versioned Supabase schema, ingestion/deletion Edge Functions, reporting views, retention policy, local/hosted database tests, Edge Function contract tests, and certification documentation.
  • Clarified that acquisition telemetry is separate from Aptabase feature analytics and from the future Private Beta program registry and run-level safety measurement.

Release boundary: the telemetry client and backend foundation are included, but production transmission remains hard-disabled until the documented hosted privacy, ownership, disclosure, and release gates are completed.

Workspace CSV exports

  • Fixed Workspace/Location filters being ignored after the export form modernization (D-256), including Name, Capacity, Type, Calling, and Calendar filters.
  • Added clear user feedback for API failures and zero-result filters instead of silent failure or a permanently spinning Generate button.
  • Prevented empty CSV files from being created when no workspaces match or when required detail/license retrieval fails.
  • Added cross-runner regression coverage for filter collection and CSV failure feedback.

Scheduled automation

  • Restricted scheduler administration and audit IPC operations to the authorized main application page (D-249).
  • Made job creation and cancellation wait for durable persistence before reporting success (D-250).
  • Added strict schema validation and explicit approval before imported jobs can become active (D-251).
  • Made audit-history writes serialized, durable, and failure-aware (D-252).
  • Unified fresh and rehydrated jobs behind a versioned intent contract and shared executor factory (D-253).
  • Added durable, normalized job-attempt and endpoint outcome history (D-254).
  • Preserved countdowns for queued jobs while another job is running (D-255).
  • Closed scheduler cleanup races and test-owned timer leaks so automated test processes terminate cleanly.

Security and reliability

  • Added OAuth scope-version tracking, reconnect guidance for older grants, and capability-specific 401/403 feedback (D-243).
  • Hardened renderer-to-main xAPI execution with page capabilities, request validation, active-organization binding, and main-process credential resolution (D-195).
  • Secured Button Inventory rendering, surfaced retrieval failures, and reduced response logging (D-194, D-196, D-198).
  • Hardened Tag Schema import validation, preview settlement, paginated discovery disclosure, terminal deployment results, fleet-plan validation, and CSV formula neutralization (D-199 through D-204).
  • Added organization-safe endpoint resolution and additional IPC authorization/validation coverage.

QR code output

  • Improved generated QR image quality and output consistency.
  • Added bounded output policy and main-process validation for QR options.
  • Correctly encodes banner text for SVG output and adapts long banner text with readable scaling, wrapping, and ellipsis (D-240, D-245).
  • Improved center-image handling and renderer-output security coverage.

Build, packaging, and dependencies

  • Standardized development and CI on Node.js 24 LTS and the authoritative npm lockfile; removed the legacy Yarn lockfile.
  • Updated Electron to 41.10.6, Sharp to 0.35.3, and applied non-breaking dependency security updates.
  • Added supported-platform package gates and packaged-application smoke verification for macOS and Windows (D-246, D-247).
  • Restored clean Jest build-gate execution and compatibility between Jest and the bundled Mocha unit suite.
  • Updated the application version to 16.3.6 and excluded generated webpack license artifacts and documentation screenshots from source control.

Project and documentation

  • Established the independent MIT project identity and updated the support contact.
  • Added independence/account migration planning, telemetry implementation and privacy documentation, database certification evidence, and updated defect records.

Known items

  • General Inventory wake IPC hardening remains tracked separately as D-244.
  • macOS application-identity migration remains tracked as D-248 and requires an upgrade/permissions migration decision.
  • Additional QR resource-bound and Open Folder feedback work remains tracked as D-241 and D-242.

Full changelog: voipnorm/CE-Deploy3.0@v16.3.5...v16.3.6

Assets 11
Loading