Notable features:
- Add OIDC login support. See OIDC Docs (#433 via #941, #977, #982, #1003)
- Thanks to @KovachVL and @alanturing881 for reporting security issues for this feature.
- Add session elevation for sensitive actions in the web UI. Session Elevation Docs (GHSA-3hcj-9m7p-wwm9, #944 via #952, #954).
- Automatically delete inactive clients/sessions (#943 via #959)
Breaking changes:
- The
config.ymlfile is no longer supported, convert it to the new env format withmigrate-config. - If you set list or map environment variables, their syntax changed, see List and map syntax.
- API tokens are no longer returned in the GET endpoints and are only exposed on creation or rotation. See Tokens are only shown once.
- If you have scripts hitting client-token endpoints, they may now need elevation.
- The paging.next URL in message list responses is now a relative path. See Paging next URL is relative.
Miscellaneous changes:
- Rework configuration (#366, #392 via #967)
- Don't store tokens in plain text (#325 via #971 by @eternal-flame-AD)
- Publish a
gotify/server:masterdocker image for testing unreleased changes. Docs: Testing master (#953, #956) - Allow sending messages with a client token (#964)
- Allow refreshing application tokens (#985 via #986 by @eternal-flame-AD)
- Increase token keyspace to >128 bits (#936 via #939 by @eternal-flame-AD)
- Switch logging to zerolog (#962)
- Add OCI labels to docker images (#924 via #927 by @eternal-flame-AD)
- Use use HTTP-only session cookies instead of local storage for UI sessions (#941)
- Add
createdAtto users, clients, applications and plugins (#959) - Add a CLI with
gotify serve,gotify versionandgotify migrate-configcommands (#967) - Fix Messenger plugins that are added after init (#653 via #998 by @TowyTowy)
- Update dependencies