🚀 What's New in 1.2.0
✨ Features
- BASE_PATH support for reverse-proxy path-prefix deployments, including Moonlight, OIDC login, cookies, router navigation and uploads (@SamJongenelen, @kotoxie)
- Active Sessions admin view showing who is connected (@aetasoul)
- Prompt to trust a changed SSH host key
- Block deleting a user who owns shared resources (@aetasoul)
- Client test runner with RDP key handling coverage (@tomknowstech)
🐛 Fixes
- SSH/Telnet sessions now end immediately when their tab is closed
- WebSocket proxy lifecycle: connection-limit slot leaks, double teardown, upstream close when the browser leaves mid-connect, and one-time password timeout cleanup (@aetasoul)
- CSV export formula injection neutralized in exports and the audit log CSV (@aetasoul)
- Firefox RDP paste popup fixed by syncing the clipboard from paste events (#68)
- Foreign key enforcement kept across database saves and migrations (@aetasoul)
- Security hardening (@aetasoul):
- OIDC state bound to the browser via cookie
- OIDC id_token claims validated
- Unique session tokens
- Sessions revoked on user admin actions
- IP rules applied to WebSocket upgrades and /mlw
- Trusted proxies matched with the shared CIDR matcher
- Migrations gated on the applied set instead of MAX
🧹 Chores
- Upgraded nodemailer to 10.0.15
- Bumped basic-ftp from 6.2.0 to 6.2.1 (@dependabot)
- Cleared CodeQL findings in the OIDC base-path test and RDP clipboard code
- Release notes now generated from merged PR metadata