octopusreview/octopus v1.4.1-rc.1 on GitHub

RC images use the base application version and do not move latest aliases.
Stable images promote accepted RC digests without rebuilding.

Octopus Cloud can now connect to private LAN/VPN Forgejo through a local
connector. Choose your setup at https://octopus-review.ai/docs/integrations#forgejo.
The standalone connector image is
ghcr.io/octopusreview/octopus-selfhost:forgejo-connector-1.4.1-rc.1.

Before upgrading, read this version's Upgrade notes.
They specify the order for updating services and applying migrations.
Schema prerequisites may need migrations first; a new model catalog
entry may need compatible web and review workers running first.

Prepare the self-hosted upgrade:

git fetch --tags && git checkout vX.Y.Z    # for the compose file + migrations
export OCTOPUS_VERSION=1.4.1-rc.1
docker compose -f docker-compose.selfhost.yml pull

Follow the Upgrade notes before running docker compose -f docker-compose.selfhost.yml up -d
and bunx prisma migrate deploy from packages/db with your configured
DATABASE_URL. The runtime image ships no migrations; use the tag checkout.

Then verify:

curl -fsS http://localhost:43300/api/health    # expect {"status":"ok"}
curl -fsS http://localhost:43300/api/version   # confirm the new version

The in-app Updates page (Settings → System → Updates) shows when a new
release is available, along with this upgrade snippet.

What's Changed

fix(indexing): stop batches after persistent GitHub blob denial by @cemoso in #985
fix(web): honor configured Qdrant API key by @cemoso in #986
fix(web): preserve review summary publication time after lock waits by @cemoso in #987
fix(web): redact provider errors in review failures by @cemoso in #988
fix(web): add indexing milestones to deadline diagnostics by @cemoso in #989
fix(web): protect community review persistence across repository transfers by @cemoso in #993
fix(web): recheck repository transfers under row locks by @cemoso in #991
fix(web): bind local index uploads to repository identity by @cemoso in #992
fix(reviews): reject moved community repositories at admission by @cemoso in #994
fix(reviews): protect terminal community jobs and tokens by @cemoso in #995
fix(web): protect sensitive data in Sentry error events by @cemoso in #997
fix(ai): select only the active provider key by @cemoso in #998
fix(diagnostics): sanitize Ask Octopus provider errors by @cemoso in #999
fix(reviews): protect embedding failure diagnostics by @cemoso in #1000
fix(cli): keep review provider diagnostics private by @cemoso in #1001
fix(reviews): classify provider failures by key ownership by @cemoso in #1002
fix(action): protect review failure diagnostics by @cemoso in #1003
fix(reviews): protect preparation failure diagnostics by @cemoso in #1004
fix(reviews): retain safe generation failure evidence by @cemoso in #1005
fix(telemetry): retain ambiguous organization-key failures by @cemoso in #1006
test(reviews): verify best-effort outcome contention by @cemoso in #1007
fix(reviews): protect publication failure diagnostics by @cemoso in #1008
fix(telemetry): sanitize error-event breadcrumbs by @cemoso in #1011
fix(sentry): scrub request metadata from trace envelopes by @cemoso in #1012
fix(sentry): sanitize inherited envelope transaction names by @cemoso in #1013
fix(sentry): scrub standalone span payloads by @cemoso in #1014
chore: prepare 1.4.1 release by @cemoso in #990

Full Changelog: v1.4.0...v1.4.1-rc.1