usekaneo/kaneo v2.26.0

on GitHub

Security release: upgrade as soon as you can

This release closes a broad set of security issues across authorization, integrations, notifications, realtime delivery and deployment defaults. Self-hosted instances on 2.25.0 and earlier are affected. Advisories with full details will be published shortly.

Read the breaking changes below before upgrading. Some of them stop the API from starting or change how it is reached.

BREAKING CHANGES

• AUTH_SECRET is now required. It previously fell back to an empty value, which Better Auth replaced with a publicly known default secret, making every session cookie forgeable offline. The API now refuses to start without a secret of at least 32 characters. The Docker entrypoint still generates one when unset, so Compose and the published images keep working; deployments that bypass the entrypoint must set it. Generate one with openssl rand -hex 32.
• project:share is now enforced. Holding project:update no longer lets a user publish or unpublish a project. Grant project:share to any role that should manage project visibility.
• API and web must be upgraded together. Task lists are now bounded and paginated. Custom clients must follow pagination.totalPages, follow relatedPage through pagination.relatedTotalPages, and treat a deferred description as "not loaded" rather than empty.
• TRUSTED_PROXIES now defaults to loopback only. Set it to your actual immediate proxy addresses or CIDRs, or client IPs will be attributed to the proxy.
• Compose no longer publishes PostgreSQL on the host. Port 5432 is no longer bound to all interfaces. Connect over the Docker network instead.
• GitHub integrations need reverifying. Bindings without a verified numeric repository and installation stop syncing until a repository admin reconnects them.
• WebSocket clients must send an Origin or explicit credentials. Cookie-only native clients are now rejected.
• SMTP_IGNORE_TLS=true is no longer supported. It disabled STARTTLS rather than certificate validation. Trust your SMTP CA with NODE_EXTRA_CA_CERTS, or for an intentionally unencrypted local relay set SMTP_SECURE=false and SMTP_REQUIRE_TLS=false explicitly.
• The Helm chart now requires kaneo.env.clientUrl. It must be the public HTTP(S) origin, with no credentials, path, query or fragment. AUTH_SECRET is now read from a Secret; prefer kaneo.env.existingSecret so it is not retained in your values.

Before you upgrade

Back up PostgreSQL and verify the restore. Migrations 0046 through 0050 run on start; 0047 deletes API keys that have no owner, so reissue any key that stops working rather than restoring it. Rotate AUTH_SECRET if it was previously readable in Helm values or a Deployment manifest.

Features

• add maintainer-triggered Peekareview code reviews: 65bb146
• peekareq: add budgeted private code-review evaluation: a8151a8

Bug Fixes

• require AUTH_SECRET and gate project visibility changes: 156b72b
• enforce security boundaries and bound integration workloads: 71bd198
• handle review relay redirects and explicit reruns: a6ea057
• web: use HttpError across fetchers: #1751
• web: prevent 404 on activity query when taskId is undefined: #1750

Reverts

• remove Peekareq code-review experiment: 4169b98

Documentation

• update contributors and sponsors: 0982593
• update contributors and sponsors: f94a27e

Credits

Huge thanks to @randoneering for helping!