Skip to content

chore(release): prepare 3.0.1 #161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sabrydawood merged 1 commit into from
Oct 28, 2026
Merged

chore(release): prepare 3.0.1 #161

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 23 additions & 5 deletions docs/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

---

## [3.0.1] — 2026-10-27
## [3.0.1] — 2026-10-28

**Status:** 🟢 Released
**Theme:** Security hotfix. Upgrade promptly and complete the mandatory
Expand Down Expand Up @@ -36,6 +36,15 @@ secret rotation in
placeholder secrets; the process environment overrides `.env`.
- **OPS-H1 — Dependencies.** Vulnerable dependencies updated (including
nodemailer 10); the CI audit gate is blocking for high/critical.
- **SEC-C2 — Open sockets.** Connected sockets are re-authorized every 30
seconds and right after a role change, deactivation, deletion or
membership removal, so they leave rooms the user can no longer see.
- **SEC-H4 — Creator access.** Project access is decided by membership
alone. Migration `023` gives every existing creator an owner membership,
so removing a creator from a project now removes their access, including
delete.
- **Credential redaction.** Repository URL credentials are stripped from
failed command errors before they reach deployment logs or the database.

### Fixed

Expand All @@ -50,7 +59,14 @@ secret rotation in

- `GET /api/auth/registration-status`.
- `npm run rotate:webhook-secrets` to rotate project webhook secrets.
- Migration `022_create_mfa_challenges_and_2fa_lockout`.
- Migrations `022_create_mfa_challenges_and_2fa_lockout` and
`023_backfill_creator_memberships`.

### Changed

- Dependencies: express 5.3, express-rate-limit 8.7, mysql2 3.24,
socket.io 4.8.4, fs-extra 11.4.1, and the development tools.
- The client is built with bun (see the client repository).

### Breaking changes

Expand All @@ -60,10 +76,12 @@ stricter repository URL / branch / rsync validation; production refuses
insecure secrets; Node.js >= 20. Details and upgrade steps:
[guides/security-hotfix-3.0.1.md](./guides/security-hotfix-3.0.1.md).

### Known gaps
### Client

- UI-H0: the v3.0 client source is not in the client repository, so the
bundled UI could not be rebuilt with the client-side changes.
- UI-H0 is resolved: the v3.0 client source is back in the client
repository with the 3.0.1 changes (authenticated sockets, the cookie-bound
2FA flow, write-only secrets), its own CI, and bun as the package manager.
Release the server and the client together as 3.0.1.

---

Expand Down
Loading