The security and infrastructure release. Everything since 0.9.0 closes a defect in the shipped image or makes an install upgradable. Upgrading from 0.9.0 needs one extra step; see Migration in CHANGELOG.md.
Run it
git clone https://github.com/Cloud-City-Computing/c2.git
cd c2
cp .env.example .env # fill in DB and admin credentials; SMTP is optional
docker compose -f docker-compose-release.yml upThat pulls ghcr.io/cloud-city-computing/cloud-codex:0.10.0.
Security
- OAuth state is bound to the browser that started the flow (GHSA-34pj-8475-rqwf, high). Before this fix, a GitHub account link one user started could be completed by another, which stored the second person's GitHub token against the first person's account.
- The workspace is a tenant boundary. Four surfaces read a global permission flag as "may act in any workspace". They now check workspace membership.
- GitHub link routes check document access. Previously any user could read, repoint or delete another document's GitHub binding.
- Typed reset-token purpose. A 2FA challenge token was accepted by password reset.
- Logout ends the server-side session.
- A read-only collaborator can no longer rename a document.
- Pull-request discussions are scoped to the pull request.
Highlights
- A migration runner (
npm run migrate), with a checksum guard, an advisory lock, and adoption commands for an existing database or a fresh install. - A scoped service token and a workspace reader check. These are the first machine interfaces a paired product (Cloud Command) reads through. An install that sets neither is unaffected.
- Documents over 64 KiB save.
- Squad-to-GitHub-team sync paginates, so it no longer removes members past the first page.
- Keyboard-reachable document titles, and named glyph-only controls.
Known gaps
linux/amd64only.- Documents edited only over the collaborative WebSocket have a stale
html_contentuntil an explicit save. That affects search, exports and GitHub pushes.
Full detail in CHANGELOG.md.