Speakr v0.10.15-alpha

In this release, seven security reports are addressed, transcripts can be searched and corrected with find and replace, notes can be given to the summarizer, Inquire can be filtered by folder, and the dependencies of the images are pinned and verified.

Security

Thanks to @devkit415 for the seven reports below, each with a reproduction and a suggested fix.

• Links in password-reset and verification emails (#436). The links were built from the host named in the request, so with a forged X-Forwarded-Host header, a user could be sent a link to another site. They are now built from APP_BASE_URL when it is set, and a warning is logged when it is not. APP_BASE_URL should be set on every installation that sends email, and TRUSTED_PROXY_HOPS=0 on an installation without a reverse proxy in front of it.
• Remember-me cookie (#437). The cookie lasted 365 days, was sent over plain HTTP and was set for every SSO sign-in. Its Secure flag now matches SESSION_COOKIE_SECURE, and it is SameSite=Lax, lasts 30 days (REMEMBER_COOKIE_DAYS) and is set only when Remember me is ticked, which is now offered for SSO sign-ins as well. When a password is changed, reset by email or set by an administrator, the account is signed out of every other browser.
• Recording files served as a page (#438). A file uploaded with an .html name was stored with an HTML type and could be opened as a page from a public share. The type is now taken from the file's content, and recording files are served only as audio or video; any other file is served as a download, with a sandbox policy.
• Summary and notes shown from the raw text (#439). When the cleaned HTML of a summary or notes was empty, the raw text was shown as HTML instead. The cleaned HTML is now always used, and Inquire messages are shown the same way. Summaries and notes are stored as written and cleaned when they are converted to HTML, so a blockquote (> quote) or an arrow (->) is no longer changed into > when a summary is saved.
• Share target (#435). A file shared to Speakr from another site, or from another page on the same host, is refused, and each account can share up to 20 files per hour this way (SHARE_TARGET_RATE_LIMIT).
• Mixed Markdown output (#442). One Markdown converter was shared by all request threads, so the content of two pages rendered at the same time could be mixed. Each thread now has its own converter.
• gunicorn and dependency checks (#434). gunicorn is updated from 21.2.0 to 23.0.0 (CVE-2024-1135, CVE-2024-6827). The locked packages are checked against the published advisories in CI with pip-audit, and Dependabot is configured for Python packages, Docker images and GitHub Actions.

Added

• Find and replace in the transcript editors (#440). A misspelled name or term can be found and replaced in the whole transcript (Ctrl+F or Ctrl+H, Cmd on macOS), with a match count, case and whole-word options, and replacement one at a time or all at once. Thanks to @astrokat-dev.
• Notes in summaries (#440). With Notes in Summaries turned on under Account > Prompt Options, the recording's notes are given to the summarizer as context, for example the agenda, names or an email thread. Thanks to @astrokat-dev.
• Folder filter in Inquire (#428). Inquire can be limited to one or more folders, together with tags. In API v1, the filter is filters.folder_ids. Thanks to @HenkieTenkie62.
• operationId in the API specification (#443). Every operation in /api/v1/openapi.json has an operationId, so Speakr can be added to Open WebUI as an OpenAPI tool server. Thanks to @HenkieTenkie62.

Changed

• Error display. A failed transcription is shown in red whatever the cause; the cause is shown by the icon and the title. The technical details are opened below the actions, with a copy button, and the messages that follow from the failure (summary, chat) are shown as information. Warnings are shown in amber everywhere.
• Dependencies pinned and verified. Every Python package is installed from a lock file with its hashes, the base image is pinned by digest, the vendored JavaScript, CSS and fonts are pinned to exact versions and checked against their checksums, and the GitHub Actions are pinned to commits.

Fixed

• Long file names (#430). An upload whose file name had 208 characters or more failed with HTTP 500. The stored file name is now shortened, and titles are cut to 200 characters wherever they are set. Thanks to @devkit415.
• Recording deleted during transcription (#432). When a recording was deleted while its transcription job ran, the job failed with database errors and was retried. Such a job is now marked as failed, without retries or webhooks. Thanks to @devkit415.
• Recording list on large installations (discussion #441). An index on the transcript chunks by recording is added, and the recordings are counted without sorting. Thanks to @devkit415.
• Usernames set by an administrator. A username longer than 20 characters caused a server error on PostgreSQL. It is now refused with a message.

Dependencies

• gunicorn 21.2.0 → 23.0.0, Flask 3.1.0 → 3.1.3, Werkzeug 3.1.3 → 3.1.9, bleach 6.1.0 → 6.4.0, python-dotenv 1.0.0 → 1.2.2.
• FFmpeg (lite image) n8.1.3-6 → n8.1.3-18.
• All other packages and vendored files are at the versions of v0.10.14-alpha, now pinned.

Upgrading

Pull the new image and start as usual. Two columns are added to the user table (session_version, summary_include_notes) and one index to the transcript chunks at startup.

• Set APP_BASE_URL to the address of your installation if Speakr sends email, and TRUSTED_PROXY_HOPS=0 if no reverse proxy is in front of it.
• Sign-ins made before this version stay valid until the account's password is next set.
• New optional settings: REMEMBER_COOKIE_DAYS (default 30) and SHARE_TARGET_RATE_LIMIT (default 20 per hour).

Full Changelog: v0.10.14-alpha...v0.10.15-alpha