This release closes a broad set of security issues across authorization, integrations, notifications, realtime delivery and deployment defaults. Self-hosted instances on 2.25.0 and earlier are affected. Advisories with full details will be published shortly.
Read the breaking changes below before upgrading. Some of them stop the API from starting or change how it is reached.
BREAKING CHANGES
AUTH_SECRET is now required. It previously fell back to an empty value, which Better Auth replaced with a publicly known default secret, making every session cookie forgeable offline. The API now refuses to start without a secret of at least 32 characters. The Docker entrypoint still generates one when unset, so Compose and the published images keep working; deployments that bypass the entrypoint must set it. Generate one with openssl rand -hex 32.
project:share is now enforced. Holding project:update no longer lets a user publish or unpublish a project. Grant project:share to any role that should manage project visibility.
API and web must be upgraded together. Task lists are now bounded and paginated. Custom clients must follow pagination.totalPages, follow relatedPage through pagination.relatedTotalPages, and treat a deferred description as "not loaded" rather than empty.
TRUSTED_PROXIES now defaults to loopback only. Set it to your actual immediate proxy addresses or CIDRs, or client IPs will be attributed to the proxy.
Compose no longer publishes PostgreSQL on the host. Port 5432 is no longer bound to all interfaces. Connect over the Docker network instead.
GitHub integrations need reverifying. Bindings without a verified numeric repository and installation stop syncing until a repository admin reconnects them.
WebSocket clients must send an Origin or explicit credentials. Cookie-only native clients are now rejected.
SMTP_IGNORE_TLS=true is no longer supported. It disabled STARTTLS rather than certificate validation. Trust your SMTP CA with NODE_EXTRA_CA_CERTS, or for an intentionally unencrypted local relay set SMTP_SECURE=false and SMTP_REQUIRE_TLS=false explicitly.
The Helm chart now requires kaneo.env.clientUrl. It must be the public HTTP(S) origin, with no credentials, path, query or fragment. AUTH_SECRET is now read from a Secret; prefer kaneo.env.existingSecret so it is not retained in your values.
Before you upgrade
Back up PostgreSQL and verify the restore. Migrations 0046 through 0050 run on start; 0047 deletes API keys that have no owner, so reissue any key that stops working rather than restoring it. Rotate AUTH_SECRET if it was previously readable in Helm values or a Deployment manifest.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [kaneo](https://github.com/usekaneo/kaneo) | minor | `v2.25.0` → `v2.26.0` |
---
### Release Notes
<details>
<summary>usekaneo/kaneo (kaneo)</summary>
### [`v2.26.0`](https://github.com/usekaneo/kaneo/releases/tag/v2.26.0)
[Compare Source](https://github.com/usekaneo/kaneo/compare/v2.25.0...v2.26.0)
#### Security release: upgrade as soon as you can
This release closes a broad set of security issues across authorization, integrations, notifications, realtime delivery and deployment defaults. Self-hosted instances on 2.25.0 and earlier are affected. Advisories with full details will be published shortly.
Read the breaking changes below before upgrading. Some of them stop the API from starting or change how it is reached.
##### BREAKING CHANGES
- **`AUTH_SECRET` is now required.** It previously fell back to an empty value, which Better Auth replaced with a publicly known default secret, making every session cookie forgeable offline. The API now refuses to start without a secret of at least 32 characters. The Docker entrypoint still generates one when unset, so Compose and the published images keep working; deployments that bypass the entrypoint must set it. Generate one with `openssl rand -hex 32`.
- **`project:share` is now enforced.** Holding `project:update` no longer lets a user publish or unpublish a project. Grant `project:share` to any role that should manage project visibility.
- **API and web must be upgraded together.** Task lists are now bounded and paginated. Custom clients must follow `pagination.totalPages`, follow `relatedPage` through `pagination.relatedTotalPages`, and treat a deferred description as "not loaded" rather than empty.
- **`TRUSTED_PROXIES` now defaults to loopback only.** Set it to your actual immediate proxy addresses or CIDRs, or client IPs will be attributed to the proxy.
- **Compose no longer publishes PostgreSQL on the host.** Port 5432 is no longer bound to all interfaces. Connect over the Docker network instead.
- **GitHub integrations need reverifying.** Bindings without a verified numeric repository and installation stop syncing until a repository admin reconnects them.
- **WebSocket clients must send an `Origin` or explicit credentials.** Cookie-only native clients are now rejected.
- **`SMTP_IGNORE_TLS=true` is no longer supported.** It disabled STARTTLS rather than certificate validation. Trust your SMTP CA with `NODE_EXTRA_CA_CERTS`, or for an intentionally unencrypted local relay set `SMTP_SECURE=false` and `SMTP_REQUIRE_TLS=false` explicitly.
- **The Helm chart now requires `kaneo.env.clientUrl`.** It must be the public HTTP(S) origin, with no credentials, path, query or fragment. `AUTH_SECRET` is now read from a Secret; prefer `kaneo.env.existingSecret` so it is not retained in your values.
##### Before you upgrade
Back up PostgreSQL and verify the restore. Migrations 0046 through 0050 run on start; 0047 deletes API keys that have no owner, so reissue any key that stops working rather than restoring it. Rotate `AUTH_SECRET` if it was previously readable in Helm values or a Deployment manifest.
***
##### Features
- add maintainer-triggered Peekareview code reviews: [65bb146](https://github.com/usekaneo/kaneo/commit/65bb146c74f5c5118e7a54951c1584ec065f0960)
- **peekareq:** add budgeted private code-review evaluation: [a8151a8](https://github.com/usekaneo/kaneo/commit/a8151a8d6c51af1227095482c1d5297db5f5ffbb)
##### Bug Fixes
- require AUTH\_SECRET and gate project visibility changes: [156b72b](https://github.com/usekaneo/kaneo/commit/156b72b3b66415bffee6732788631bdcb11781f3)
- enforce security boundaries and bound integration workloads: [71bd198](https://github.com/usekaneo/kaneo/commit/71bd1983a77f5e5a13bcc1b483894f6b8523dbb5)
- handle review relay redirects and explicit reruns: [a6ea057](https://github.com/usekaneo/kaneo/commit/a6ea05715d5eedaded5c1ee94ea715e093a97a21)
- **web:** use HttpError across fetchers: [#​1751](https://github.com/usekaneo/kaneo/issues/1751)
- **web:** prevent 404 on activity query when taskId is undefined: [#​1750](https://github.com/usekaneo/kaneo/issues/1750)
##### Reverts
- remove Peekareq code-review experiment: [4169b98](https://github.com/usekaneo/kaneo/commit/4169b98f4f9f273a0ba524b5fd058d0a235ea22a)
##### Documentation
- update contributors and sponsors: [0982593](https://github.com/usekaneo/kaneo/commit/0982593b8206622c6f7e9bf774d39207bcf002b9)
- update contributors and sponsors: [f94a27e](https://github.com/usekaneo/kaneo/commit/f94a27e63019e98481de616ef95f039d84b3ec96)
##### Credits
Huge thanks to [@​randoneering](https://github.com/randoneering) for helping!
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDYuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEwNi4wIiwidGFyZ2V0QnJhbmNoIjoiZnJlc2gtc3RhcnQiLCJsYWJlbHMiOltdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v2.25.0→v2.26.0Release Notes
usekaneo/kaneo (kaneo)
v2.26.0Compare Source
Security release: upgrade as soon as you can
This release closes a broad set of security issues across authorization, integrations, notifications, realtime delivery and deployment defaults. Self-hosted instances on 2.25.0 and earlier are affected. Advisories with full details will be published shortly.
Read the breaking changes below before upgrading. Some of them stop the API from starting or change how it is reached.
BREAKING CHANGES
AUTH_SECRETis now required. It previously fell back to an empty value, which Better Auth replaced with a publicly known default secret, making every session cookie forgeable offline. The API now refuses to start without a secret of at least 32 characters. The Docker entrypoint still generates one when unset, so Compose and the published images keep working; deployments that bypass the entrypoint must set it. Generate one withopenssl rand -hex 32.project:shareis now enforced. Holdingproject:updateno longer lets a user publish or unpublish a project. Grantproject:shareto any role that should manage project visibility.pagination.totalPages, followrelatedPagethroughpagination.relatedTotalPages, and treat a deferred description as "not loaded" rather than empty.TRUSTED_PROXIESnow defaults to loopback only. Set it to your actual immediate proxy addresses or CIDRs, or client IPs will be attributed to the proxy.Originor explicit credentials. Cookie-only native clients are now rejected.SMTP_IGNORE_TLS=trueis no longer supported. It disabled STARTTLS rather than certificate validation. Trust your SMTP CA withNODE_EXTRA_CA_CERTS, or for an intentionally unencrypted local relay setSMTP_SECURE=falseandSMTP_REQUIRE_TLS=falseexplicitly.kaneo.env.clientUrl. It must be the public HTTP(S) origin, with no credentials, path, query or fragment.AUTH_SECRETis now read from a Secret; preferkaneo.env.existingSecretso it is not retained in your values.Before you upgrade
Back up PostgreSQL and verify the restore. Migrations 0046 through 0050 run on start; 0047 deletes API keys that have no owner, so reissue any key that stops working rather than restoring it. Rotate
AUTH_SECRETif it was previously readable in Helm values or a Deployment manifest.Features
Bug Fixes
Reverts
Documentation
Credits
Huge thanks to @randoneering for helping!
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.