blinkospace/blinko 1.8.9

Blinko 1.8.9

on GitHub

Blinko 1.8.9 is a security update. Upgrade the server and clients together.

Security fixes

• Require a valid password before linking an existing account; require a first-factor challenge and bounded attempts for 2FA login.
• Enforce conversation/message ownership and restrict AI provider secrets and administrative writes.
• Enforce attachment ownership and current sharing permissions while preserving owner exports, internal shares and protected-share media.
• Validate and pin public HTTP destinations, recheck redirects, and bound request time and response size.
• Serve uploaded active content with safe download/content headers and private cache policy.
• Restrict plugin filesystem paths and require server-operator approval for MCP stdio command/argument/environment tuples.
• Generate RSS/Atom links from the configured application origin instead of request Host/Origin headers.

Upgrade notes

• Update frontend/native/custom 2FA clients together with the server. Existing authenticated sessions remain valid; restart incomplete 2FA logins.
• Existing stdio MCP configurations are denied until the operator explicitly approves them with BLINKO_MCP_STDIO_ALLOWLIST. HTTP MCP transports retain their existing behavior.
• Set NEXT_PUBLIC_BASE_URL or NEXTAUTH_URL to the public application origin. Purge previously cached attachment responses at your CDN/proxy.
• Back up the database and file volumes. This update introduces no Prisma schema or migration changes. An isolated PostgreSQL 14.23 old-version → patched-version → old-version test preserved application data and login/file access. Returning to 1.8.8 restores its vulnerabilities; prefer a forward fix.

Validation

184 security regression tests passed on Bun 1.2.8, along with targeted strict TypeScript checks and frontend/backend production builds. The actual tagged Linux amd64 container also passed full startup, password login, private/internal/public/protected attachment access, and owner-only Markdown/CSV/JSON export downloads against an isolated legacy-format PostgreSQL database. Desktop updater signatures were verified against the application public key. The Android APK signature matches 1.8.8, with versionName 1.8.9 and versionCode 1008009. Full-project TypeScript validation, every external OAuth/object-storage deployment and production load are not covered by these checks.

See upgrade and rollback guidance. Security advisory/CVE publication and duplicate assessment are tracked separately from this software release.