av/harbor v0.5.20

on GitHub

Security

• Open WebUI no longer ships with a public session-signing secret. New installs get a random per-install key, and harbor doctor and harbor up webui warn when an existing install still uses the old h@rb0r default (#307, reported by @gdevenyi).

  Existing installs keep their current value, because rotating it logs every user out and resets MFA enrolment. To rotate:

  harbor webui secret "$(openssl rand -base64 48)" >/dev/null 2>&1
  harbor restart webui

Fixes

• harbor doctor no longer exits silently on podman systems, so install.sh and the Harbor App setup check pass there too (#304, reported by @gdevenyi).
• MetaMCP now builds on podman (#306, reported by @gdevenyi).
• mcpo starts again with current FastAPI releases (#305, reported by @gdevenyi).

New

• Boost: set HARBOR_UBERLLM_API_KEY to add UberLLM's models as a Boost backend (#308 by @PSA-Team-source).

Full Changelog: v0.5.19...v0.5.20