jR4dh3y/BoxBox v0.3.1

BoxBox v0.3.1 security update

on GitHub

Security update

BoxBox v0.3.1 fixes GHSA-jj9r-xc63-6c4p. All users must sign in again after upgrading.

The active-session registry, auth-sessions.json, lives under data_dir. Keep data_dir on persistent storage and run one server process per directory. On startup, a missing registry or a valid version 1 snapshot with no sessions rejects old tokens and lets users sign in again. A zero-byte, malformed, unreadable, non-regular, unsupported, or future-version registry stops startup. Restore a valid backup rather than resetting it. Rotate BOXBOX_JWT_SECRET after restoring an older backup or downgrading to a version that ignores the registry.

Upgrade

Keep the existing data volume and credentials, then update Docker Compose:

BOXBOX_IMAGE=ghcr.io/jr4dh3y/boxbox:v0.3.1 docker compose pull
BOXBOX_IMAGE=ghcr.io/jr4dh3y/boxbox:v0.3.1 docker compose up -d

The published v0.3.1, 0.3.1, and latest image tags include Linux amd64 and arm64. For a standalone installation, extract the matching binary archive, configure the included config.yaml, and start ./boxbox --config config.yaml.

See the release and recovery guide before restoring backups or downgrading.

Verification

• go vet ./... passed.
• go test -race ./internal/service -run 'TestConcurrentRefreshHasOneWinnerAndReplayCannotKillWinner|TestLogoutIsSessionWideAndReplayCannotTerminateWinner' -count=1 passed.
• go test ./... passed.
• bun install --frozen-lockfile passed in frontend/ and website/.
• bun run check and bun run build passed in frontend/. The build emitted advisory warnings for chunks larger than 500 kB.
• bun run build passed in website/. Astro noted that local Node.js 26 is unsupported by Vercel Functions and selected Node.js 24 for deployment.
• scripts/build-single.sh built the self-contained Linux amd64 binary with embedded frontend assets. Linux amd64 and arm64 stripped, statically linked binaries were packaged from release commit b0bbf76c6c1ef6ac5e93ceff85efa3f7517fa1ea.
• bun scripts/check-auth-sessions.ts --binary <binary> passed against the amd64 binary extracted from the rebuilt archive. The smoke suite confirmed legacy and unknown-session rejection, session-wide logout, replay behavior, persistence-failure retry, strict registry startup checks, and missing/empty-registry recovery.
• Both archives passed sha256sum -c SHA256SUMS and tar -tzf integrity/listing checks.

The smoke harness also confirmed the expected risks: restoring an older valid registry can revive its sessions, and deleting the registry while the server is running does not clear loaded sessions. Restart the server to discard loaded in-memory state.

The release workflow passed preflight and published both container architectures. Registry verification confirmed all release tags point to the same image index and both architecture images identify the release commit. The amd64 server extracted from the published image also passed the real-server authentication smoke suite.

Image index digest: sha256:899052a002a8a1881a20329edc1d6d6f9632ba1d8e572bec43322735aaae06dd.

The arm64 binary was cross-compiled but not runtime-tested on arm64 hardware. The local Docker daemon was unavailable; container builds ran in GitHub Actions, and the published amd64 entrypoint was exercised outside a container.

Assets

• boxbox-v0.3.1-linux-amd64.tar.gz
• boxbox-v0.3.1-linux-arm64.tar.gz
• SHA256SUMS

SHA-256:

197f0a100f5fdc3f95718a538e524ae28d8cc2297f4e9de7698ea4b124b277bb  boxbox-v0.3.1-linux-amd64.tar.gz
0a258b32fa66f3bf9b5797c1f1726c8333d76884ace53d7df6e5f91660139346  boxbox-v0.3.1-linux-arm64.tar.gz