What's Changed
- Feat/documentation 321 by @Kent1mrqs in #334
- Deploy Docusaurus documentation to development and main by @Impre-visible in #336
- Merge dev into main by @Kent1mrqs in #357
- Add sync-schema for migration with previous Prisma release by @Impre-visible in #367
- fix(main): resolve package.json via __dirname instead of cwd by @Kent1mrqs in #369
- Fix/quote preview pdf 372 by @Kent1mrqs in #374
- Feat/expenses by @Kent1mrqs in #375
- Feat/multi company by @Kent1mrqs in #376
- Feat/mcp server by @Kent1mrqs in #377
- fix: only run the v1.4.4a leveling push on legacy db-push instances by @Kent1mrqs in #378
- feat: support full markdown in quote/invoice notes by @Kent1mrqs in #384
- feat: add country-aware thousands separator to invoice/quote amounts by @Kent1mrqs in #385
- fix : switch draft status to sent status before sending invoice/quote by @Kent1mrqs in #386
- fix: persist signedAt on quote when signature is completed by @Kent1mrqs in #387
- fix: correct baseURL typo in better-auth config by @Kent1mrqs in #388
- Add Claude Code GitHub Workflow by @Impre-visible in #395
- fix: use instance URL and favicon.svg in Discord webhook by @Impre-visible in #396
- fix: show all webhook events as a list instead of truncated text by @Impre-visible in #397
- Compliance engine v2: country catalogs, proven transports, hosted offering, Lagune UI by @Impre-visible in #401
- dev into main by @Kent1mrqs in #370
Security
Three advisories affecting the 1.x line are resolved in this release. All three were reported privately, through the channel SECURITY.md asks for.
- GHSA-7vg5-q3gv-jx97 (high) — webhook delivery made server-side requests to any URL an administrator could type, with no outbound-URL guard.
- GHSA-vhjw-gwc5-pjfp (high) — the one-time code standing between a signature link and a legally signed quote could be brute-forced. Reported by @archnexus707
- GHSA-g76v-ff9h-j6r2 (medium) — a payment method belonging to one company was reachable from another. Reported by @ikkyu3
Thank you. Reporting a flaw privately, and then waiting while a one-person project works through it, is a real cost to the person doing it — and the only reason these were fixed before anyone else found them.
If you run a 1.x instance, none of these are patched there and none will be. Upgrading is the fix.
Full Changelog: v1.4.5a...v2.0.0-alpha.1