onetimesecret/onetimesecret v0.26.12 on GitHub

Deployment Notes

Important

Most full-mode users will need to sign in again after deployment. Session
deadlines now run on every request, and existing sessions usually have stale
last_use values. Sessions created on v0.26.5 or later are affected; older
sessions are exempt. See
Upgrading to v0.26.12
for details.

Warn support that an increased login rate is expected.
If your edge filters path prefixes, allow POST /auth/close-account.
The full-mode delete-account action moved from /api/account/destroy
(#4394).
Tell colonel users that search now requires Enter or the submit button
(#4392).
Optionally set RODAUTH_ADMIN_URL to link the console to Rodauth Admin
(#4390).

Warning

Session revocation is now enforced. Before this release, deleting an
active-session record reported success but did not end the corresponding Rack
session. This affected revocations from account settings, sign-out everywhere,
ots sessions revoke-all, customer purges, and Rodauth Admin.

In full mode, authenticated requests now verify that the active-session
record still exists. If you revoked a session for a security reason on
v0.26.5–v0.26.11, treat it as still active and confirm the account. This fixes
finding M-14 from the 2026-08-14 application security review (#4391).

Warning

Authenticated full-mode requests now depend on the auth database. If
the active-session record cannot be checked, access is refused until the
database returns. Users do not need to sign in again after recovery; their
session data remains in Redis. These refusals log
[active_session_gate] authdb unreachable (#4391).

Also check before upgrading:

Colonel Organizations API: refresh=1 is now ignored, details.cache is
removed, and pagination.capped is new (#4392).
Audit stream: preview email/sync_provider_feedback events now include
dry_run: true (#4396, #4397).
Tenant SSO locales: add tenant_sso_link_unavailable and
identity_connect_wrong_domain if you maintain forked locale files (#4390).
Simple mode: unaffected by the active-session gate; /api/account/destroy
is unchanged.

Rollback: No migration or dependency change is required. Roll back by
deploying v0.26.11. RODAUTH_ADMIN_URL can remain configured. Sessions
created under v0.26.12 continue to work after rollback, but their active-session
records are no longer enforced.

What's Changed

Consolidate the #4337 attempt/preview audit envelope behind a shared mixin in #4396
Enforce Rodauth's active-session table on every full-mode request in #4391
Establish active security risk tracking in #4398
feat(cli): shell completion for ots (bash/zsh/fish), baked into the OCI image in #4400
Fold the last nine preview-only emitters into the shared audit envelope in #4397
Gate the sessions security card on AUTH_ACTIVE_SESSIONS_ENABLED in #4402
Give router fallback responses per-request headers in #4401
Release v0.26.12 in #4399
Unify account deletion behind TeardownAccount + rename teardown operations in #4395
Update CI job perms in #4388
Wire the three Rodauth Admin integration seams into the colonel console in #4390

Fixed

Fix Account Settings account deletion in #4394
fix(colonel): bound the organizations search and make every admin search submit-only in #4392

Full Changelog: v0.26.11...v0.26.12