Releases
Each release has Linux binaries for x86_64 and arm64, a container image, checksums.txt and build provenance. Binary installs update from Settings, System in the panel. See updates and rollback and how to verify a release.
What's Changed
- Release by tag instead of on every push to main by @Sulaiman-Dauda in #82
- feat(staging): recreate an interrupted first data copy by @kimjooyoon in #81
- Change checks: fail only on advisories with a fixed release by @Sulaiman-Dauda in #83
- build(deps): bump the go-minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #84
- feat(mcp): MCP server with read and write tools, and a deploy token scope by @Sulaiman-Dauda in #85
- build(deps): bump the web-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #76
New Contributors
- @kimjooyoon made their first contribution in #81
Full Changelog:
v0.59...v0.60Automated release from
dac7577: Unexport the staging API's internal typesAutomated release from
804db42: Remove private project names from the agent brief and testsPersonal API tokens, viewer masking and a set of security fixes.
- API tokens. Create them in Settings and send them as a bearer token. Each has a scope and an optional expiry, and admins can revoke anyone's through the API. See the API guide.
- Viewers no longer see secret values.
.envvalues and values a Compose file sets inline are masked for the viewer role. - One instance per data directory. A second Windlass started on the same data directory now refuses to run (#43).
- Cross-origin writes are refused, and the Git token no longer appears in process arguments.
- Turning off two-factor asks for a current code.
Plugin SDK changes
Both affect plugins that use the panel's proxy.
- The proxy no longer forwards the session cookie or the
Authorizationheader to the plugin. - Anything other than GET, HEAD and OPTIONS, and any WebSocket upgrade, through the proxy now needs the member role.
Releases before v0.51 are on GitHub.