emlopezr/trackwatch 2.1.2

v2.1.2 - Security updates

on GitHub

Security updates

TrackWatch 2.1.2 includes the security fixes merged into develop:

• Fixes CVE-2026-68916 / GHSA-q8v8-jxg6-hpmj: the legacy All-in-One Docker deployment could expose the Spotify OAuth client_secret through the public /env.js runtime configuration. Browser-served runtime configuration is now restricted to public frontend flags; the OAuth secret remains server-side only.
• Updates the frontend dependency graph to patched versions of fast-uri, brace-expansion, and postcss.

Action required for installations up to 2.1.1

If you deployed TrackWatch up to 2.1.1 using the All-in-One Docker image with a real Spotify client secret, treat that secret as potentially exposed even if you have no evidence of misuse. Rotate or regenerate it in the Spotify Developer Dashboard, update the secret in the deployment environment, and redeploy the application. Do not reuse the old secret.

After upgrading, verify that /env.js contains only public runtime flags and never contains SPOTIFY_CLIENT_SECRET or VITE_SPOTIFY_CLIENT_SECRET.