Upgrading

# In the same directory as the one you installed
docker compose -f docker-compose.prod.yml down

# Make edits as appropriate to the configuration (see below)

# Pull the new images
docker compose -f docker-compose.prod.yml pull

# Start the daemon
docker compose -f docker-compose.prod.yml up -d

# in the same directory as the one you cloned
docker compose down

git pull

# Make edits as appropriate to the configuration (see below)

# Build new images
docker compose up --build

Changes

This relesae addresses multiple high-severity vulnerabilities.

• Security: Replaced wildcard CORS (origin: "*") with strict origin checks. The backend now rejects requests not matching process.env.FRONTEND_URL (defaults to localhost:6767).
• Security: Implemented zod schema validation for all drawing payloads (POST/PUT). This prevents Stored XSS and malformed data injection.
• Security: Refactored SQLite import endpoint. It now writes to a temporary staging area and performs a PRAGMA integrity_check before atomically swapping the database file, preventing arbitrary file overwrites.
• Ops: Updated docker-compose.prod.yml to accept FRONTEND_URL via environment variable injection.
• Deps: Added zod and better-sqlite3 to backend dependencies.

BREAKING CHANGE:
This update requires infrastructure changes.

1. Non-localhost deployments MUST define FRONTEND_URL in docker-compose.yml.

services:
  backend:
    image: zimengxiong/excalidash-backend:latest
    # ... other settings ...
    environment:
      - DATABASE_URL=file:/app/prisma/dev.db
      - PORT=8000
      - NODE_ENV=production
      # Uses the user's system ENV var if present, otherwise defaults to localhost
      - FRONTEND_URL=${FRONTEND_URL:-http://localhost:6767}

1. Containers must be rebuilt to install new dependencies.

Full Changelog: v0.1.0...v0.1.1