Huge thanks to @tinsever and @andrejsshell for helping!
Huge thanks to @andrejsshell for helping!
Huge thanks to @tinsever, @zaralX, @TymekV, @MonsPropre, @randoneering, @rdlugs, @tbringuier, @mohiuddin000, @shiminshen, @yavilavi, @thejdubb02, @yigit-serin, @OmG3r, and @zerodarkzone for helping!
Huge thanks to @tinsever for helping!
This release closes a broad set of security issues across authorization, integrations, notifications, realtime delivery and deployment defaults. Self-hosted instances on 2.25.0 and earlier are affected. Advisories with full details will be published shortly.
Read the breaking changes below before upgrading. Some of them stop the API from starting or change how it is reached.
AUTH_SECRET is now required. It previously fell back to an empty value, which Better Auth replaced with a publicly known default secret, making every session cookie forgeable offline. The API now refuses to start without a secret of at least 32 characters. The Docker entrypoint still generates one when unset, so Compose and the published images keep working; deployments that bypass the entrypoint must set it. Generate one with openssl rand -hex 32.project:share is now enforced. Holding project:update no longer lets a user publish or unpublish a project. Grant project:share to any role that should manage project visibility.pagination.totalPages, follow relatedPage through pagination.relatedTotalPages, and treat a deferred description as "not loaded" rather than empty.TRUSTED_PROXIES now defaults to loopback only. Set it to your actual immediate proxy addresses or CIDRs, or client IPs will be attributed to the proxy.Origin or explicit credentials. Cookie-only native clients are now rejected.SMTP_IGNORE_TLS=true is no longer supported. It disabled STARTTLS rather than certificate validation. Trust your SMTP CA with NODE_EXTRA_CA_CERTS, or for an intentionally unencrypted local relay set SMTP_SECURE=false and SMTP_REQUIRE_TLS=false explicitly.kaneo.env.clientUrl. It must be the public HTTP(S) origin, with no credentials, path, query or fragment. AUTH_SECRET is now read from a Secret; prefer kaneo.env.existingSecret so it is not retained in your values.Back up PostgreSQL and verify the restore. Migrations 0046 through 0050 run on start; 0047 deletes API keys that have no owner, so reissue any key that stops working rather than restoring it. Rotate AUTH_SECRET if it was previously readable in Helm values or a Deployment manifest.
Huge thanks to @randoneering for helping!
Huge thanks to @andrejsshell for helping!
Huge thanks to @MonsPropre, @ApplesBear-X, @randoneering, @jamalkamaladdin, and @mmilanovic4 for helping!