corezoid/account 0.2.48 on GitHub

Chart 0.2.48 [Account 3.32.0] - 2026-10-26

Cumulative changes since chart 0.2.42 (includes 0.2.43–0.2.47).

A database migration (000089_logins_domain_index) runs automatically on startup.
LiteLLM users: teams created before this release keep the default model group. After deploying, run scripts/litellm_teams_all_proxy_models.sh (dry run by default, --apply to write), and only then remove the default group from the LiteLLM proxy config.
LDAP users: do not set auth_providers.ldap.idp_entity_id until the role/group maps are configured — once it is set, every login reconciles roles against the directory and removes roles that no map grants.
No changes to existing values are required; all new keys are optional.

account-frontend image moved to nginx:stable-alpine3.24 (nginx 1.30.6, Alpine 3.24) — the previous Alpine 3.20 base is end-of-life; fixes vulnerabilities in brotli (CVE-2026-111497 / USN-8956-1), curl, libxml2 and OpenSSL. No known OS-package vulnerabilities in the 3.32.1 image (amd64 and arm64)
account-frontend: DOMPurify updated to 3.4.17 (XSS fixes)
Content Security Policy hardened: removed the https://*.ngrok-free.app origin, added object-src 'none' and base-uri 'self'
OAuth2: authorization codes are bound to the client's redirect_uri, the code exchange is authenticated (client_secret, PKCE S256) and codes are single use; open redirect via //host paths closed
OAuth2: full-scope Simulator tokens are issued only to the Simulator client
LDAP: a first LDAP login is never linked to the super admin account by email; the login is escaped in the LDAP search filter
SAML: SSRF protection when fetching IdP metadata URLs — https only, private/loopback/cloud-metadata addresses refused; on-prem IdPs can opt in per provider with allow_private_metadata_url
Go runtime updated to 1.26.9 with dependency security fixes

LDAP / Active Directory
- Display name and email read from the directory (user_nick_entry / user_email_entry); a first LDAP login reuses the existing account with that email or creates a new one; entries without a usable email are refused
- Workspaces, roles and groups synced from the directory at login (same mapping as SAML), enabled with idp_entity_id; the sync never blocks a login
- LDAP provider visible in the IdP settings API (the bind password is never returned)
- Active Directory support: connect/read timeouts (default 10s), fallback_hosts for several domain controllers, clear wrong-password / disabled-account errors instead of internal errors; logins up to 100 characters (fits a userPrincipalName)
Search
- Users can be searched by login domain: @example.com matches only that domain, example.com matches the domain or regular text
- Licenses can be searched by license id, type, owner name, login or login domain, ordered by relevance
- User picker shows the contacts you select most often first
AI / LiteLLM: the model is set in the account config (litellm.model, default claude-sonnet-5; must match a model_name on your LiteLLM proxy)

Avatars — faster delivery (account-frontend nginx; settings under global.account.frontend.avatars.*, see README "Avatar delivery"):
- Browser caching: versioned avatar URLs (?v=<N>) are cached for a year, others for a day, placeholders for 2 minutes (avatars.cache.*)
- Resized poster frames for animated avatars (/avatars/animation/<WxH>/<id>.jpg), cached on the pod (avatars.poster.*, enabled by default)
- Animated avatars are encoded for delivery (480px H.264, starts playing immediately; 400–800 KB → 60–80 KB) and posters are stored as real JPEG
- Optional nightly CronJob (avatars.normalize, disabled by default) converts already stored avatars to the same format; originals are kept under <volume>/.orig/, dry_run and limit available. One-off run: kubectl -n <ns> create job --from=cronjob/<release>-avatars-normalize avatars-normalize-backfill
Barrier limits: the monthly usage window is now a stable calendar month instead of a rolling one

Avatars: unsupported avatar URLs return 404 instead of a redirect to a placeholder or a 415 error; users without an avatar get the placeholder directly
nginx JSON access log is valid JSON for static responses; expected avatar misses are no longer logged as errors
SAML/LDAP role sync: system groups (All Workspace Users, Admin, Member, Guest) are no longer touched by group maps — fixes a 400 error on LDAP login and users being removed from All Workspace Users
LDAP: attribute names are matched case-insensitively (name/email were empty on some directories)
Login no longer fails with 500 when the browser sends several token cookies (e.g. from another app on the parent domain)
SAML: the stored IdP metadata is kept when a metadata refresh fails
Workspace: fixed a crash when several pods start for the first time at once
Cloud deployments: secrets from AWS Secrets Manager load correctly at startup