LanternOps/breeze v0.66.1

on GitHub

Minor bump — no new env vars, no new migrations, no manual pre-deploy steps. The version jumps to 0.66.x to mark the SR-001..SR-009 security report sweep, but droplet upgrade is a routine BREEZE_VERSION=v0.66.1 flip + docker compose pull api web && up -d.

v0.66.0 was tagged but its release workflow failed on a single React 19 viewer build error; v0.66.1 is the first published release in the 0.66 line. The v0.66.0 tag remains as a marker but has no GitHub Release attached.

✨ Features

• Bulk Wake-on-LAN (#782) — bulk endpoint at /devices/bulk/commands with type=wake, per-device getDeviceWithOrgCheck enforcement, bulkId correlation in audit + wake_attempts, 500-device cap, concurrency 8. Web DevicesPage surfaces success/failure/mixed toasts via runAction-allowlisted typed service. Discussion #694 follow-up.

🐛 Fixes

• Discovery orgId for multi-org partners (#779) — :id handlers (bulk-approve, queue, results) now forward orgId query param so a partner with multiple orgs hits the same scope used to look up the discovery scan.
• partnerGuard combo bug (part of #781) — two latent bugs together turned every authenticated GET into a 500 after the SR-005 fail-closed branches landed. partnerGuard.ts lookup now wraps in withSystemDbAccessContext (was RLS-shadowed under breeze_app); index.ts wrapper now returns the guard's Response on every branch (was discarding → Hono "Context is not finalized" → 500). Wrapper-shape regression tests added — the existing tests mounted the guard directly and bypassed the wrapper.
• React 19 internal type fixes (#783, #785) — JSX.Element → ReactElement in apps/web/.../StatusIcon.tsx; explicit undefined init for useRef<T>() in apps/viewer/.../DesktopViewer.tsx. Both surfaced after #762 bumped @types/react to 19. No user-visible change.

🔒 Security — SR-001..SR-009 sweep (#781)

Pre-tag, every finding in security_best_practices_report.md was re-verified against real code by parallel subagents — several were severity-adjusted before fixing.

• SR-001 (High): Mobile lockout was bypassable via spoofable X-Breeze-Mobile-Device-Id header. Added signed mdid JWT claim (mobileDeviceBinding.ts); enforcement in mobileDeviceBlocked.ts keys off the signed claim scoped by device-id + user-id; header is now legacy fallback only.
• SR-002 (High→Med, entropy-gated): /devices upsert ownership guard returns 409 device_owned_by_other instead of silently re-keying.
• SR-003 (High→Low, by-design): active→pending transition unreachable; documented, no code change.
• SR-004 (Med→Low): redactPushToken() redacts Expo push tokens in logs and error payloads.
• SR-005 (Low): partnerGuard fails closed — 503 PARTNER_LOOKUP_UNAVAILABLE on DB error, 403 PARTNER_NOT_FOUND on missing partner (was failing open). See Fixes above for the combo-bug followup.
• SR-007 (Med): Top-level permissions: contents: read added to release.yml + ci.yml (privileged jobs already had per-job overrides). Regression rule added to check-supply-chain-hardening.sh.
• SR-008 (Med→Low): MCP breeze://devices/{id} resource and REST GET /devices/:id now use an allow-list projection (buildSafeDeviceProjection + stripSensitiveDeviceFields) — bearer tokens, hashes, and raw secrets never leave the API row.
• SR-009 (Med→Low): coturn compose fails closed via --static-auth-secret=${TURN_SECRET:?...}. Regression rule added to check-relay-edge-hardening.sh.

SR-006 (deferred): dashboard/docs Linux one-liner installs are TLS-only (no signed-manifest verify like auto-update). macOS/Windows have OS signature trust. Needs design decision.

📦 Dependencies

• React group: react 19.2.0 → 19.2.6, @types/react 18.3.28 → 19.2.14 (#762) — removes the global JSX namespace and the no-arg useRef overload; addressed by #783 + #785.
• @vitejs/plugin-react 4.7.0 → 6.0.2 (#769) — Vite plugin major.
• @react-native-async-storage/async-storage 2.2.0 → 3.0.2 (#767) — mobile only.
• Astro group: 3 updates (#761).
• cloud.google.com/go/storage 1.62.1 → 1.62.2 in /agent (#757).
• azure/artifact-signing-action 1.2.0 → 2.0.0 (#758) — module rename internal, action inputs unchanged.

Verified before tag: main CI green on cd8c8a8f (#785 type-check, smoke, all tests passing) · #781 smoke test confirmed end-to-end after the partnerGuard combo-bug fix · 12 PRs merged sequentially across the session with admin-merge only on green CI.

What's Changed

• fix(api): forward orgId query param in discovery :id handlers for multi-org partners by @ToddHebebrand in #779
• docs: update technical docs for v0.65.16 major release by @ToddHebebrand in #780
• chore(deps): Bump cloud.google.com/go/storage from 1.62.1 to 1.62.2 in /agent by @dependabot[bot] in #757
• chore(deps): Bump the astro group across 1 directory with 3 updates by @dependabot[bot] in #761
• chore(deps): Bump @react-native-async-storage/async-storage from 2.2.0 to 3.0.2 by @dependabot[bot] in #767
• chore(deps): Bump azure/artifact-signing-action from 1.2.0 to 2.0.0 by @dependabot[bot] in #758
• fix(web): use ReactElement instead of removed global JSX namespace by @ToddHebebrand in #783
• feat(devices): bulk Wake-on-LAN (Discussion #694 follow-up) by @bdunncompany in #782
• fix(security): resolve SR-001/002/004/005/007/008/009 from security report by @ToddHebebrand in #781
• chore(deps): Bump the react group across 1 directory with 2 updates by @dependabot[bot] in #762
• chore(deps): Bump @vitejs/plugin-react from 4.7.0 to 6.0.2 by @dependabot[bot] in #769
• fix(viewer): supply explicit undefined to useRef for React 19 by @ToddHebebrand in #785

Full Changelog: v0.65.16...v0.66.1