Zum Inhalt springen

Kaeso 0.3.7. Veröffentlicht am 22. Oktober 2026, mit 29 Änderungen.

Veröffentlicht
Änderungen
29 Änderungen
In diesem Release
Hinzugefügt, Geändert, Behoben und Sicherheit
Das Release auf GitHub (öffnet in einem neuen Tab)

Operators need to act on this release: compose.yaml changed beyond its image versions and must be installed by hand, and a reverse proxy of your own is trusted only when it is named in the trusted proxies setting. Single sign-on now starts only after the email, organization sign-in links are removed, and changing or deleting an SSO connection ends the sessions it signed in. The gateway also stops deeply nested requests from crashing it, keeps one key from holding the whole translation memory budget, and refuses unpriced models under a spend budget.

Contributors: @dvnold

Full changes: v0.3.6...v0.3.7 (öffnet in einem neuen Tab)

Hinzugefügt

  • Instance administration can be opened to one organization's single sign-on through a new instance setting, which names that organization or none, the default. An instance admin's session from that provider can then use the instance API while the organization manages the account. Changing the setting still needs a password or sign-in link, and each change is audited as instance.admin_sso_update. (#338 (öffnet in einem neuen Tab))

Console

  • An organization's Security page says when its identity provider's sign-ins can never count as recent, and GET orgs/{org}/security returns it as sso.sends_auth_time.

Geändert

  • Prometheus metrics listen on loopback by default instead of on every interface. The gateway image still listens on all interfaces inside its container, which is what the documented port mapping reaches, and Compose publishes the port nowhere. (#335 (öffnet in einem neuen Tab))
  • A sign-in through the single sign-on of the organization that manages an account now opens all of that person's organizations, and Require single sign-on applies only to those accounts. An organization manages the accounts whose address is at one of its verified domains, and guests keep their own sign-in. (#337 (öffnet in einem neuen Tab))
  • The identity provider of the organization that manages an account now owns its address. POST me/email is refused for such an account, and a sign-in through that provider replaces the stored address with a newer verified one at a verified domain. An address another account holds is never taken. (#339 (öffnet in einem neuen Tab))
  • Signing in again from a managed account's single sign-on offers that organization's identity provider first, with the password and an email link beside it. GET me/sign-in-again lists the managing organization first in sso, and a provider that doesn't send auth_time is left out. (#340 (öffnet in einem neuen Tab))

Behoben

Console

  • The sign-in-again dialog no longer keeps offering an identity provider that never sends auth_time, such as one run on Clerk. After one failed confirmation it explains why and offers the password or an email link, and a confirmation without auth_time now returns no_auth_time instead of stale_sign_in.
  • Setting up an authenticator app from a single sign-on session asks to sign in another way instead of showing an error whose Try again failed the same way.

UI library

  • A dialog that finishes closing after another dialog opened no longer takes focus from it, so a search typed into a combobox stays and its options remain. (#346 (öffnet in einem neuen Tab))

Sicherheit

  • Single sign-on starts only after the person enters their email, and the organization start link is removed. A planted link can no longer sign a signed-out browser in to another account, and links point to /sign-in instead. (#319 (öffnet in einem neuen Tab))
  • Deleting an organization's SSO connection, or saving it with a new issuer or client id, ends every session that connection signed in, and the audit entry records sessions_ended. DELETE me/sso-links/{org} likewise ends the account's sessions from that organization's SSO and now needs a recent sign-in. (#320 (öffnet in einem neuen Tab))
  • Reset links, sign-in links and the link sign-up sends to an existing account go to the account's stored address. Addresses are compared in NFKC-normalized form, so lookalike addresses no longer receive another account's links or dodge its sign-in limits. (#321 (öffnet in einem neuen Tab))
  • Confirming a new email address now signs out every other session of the account. The session that opens the confirmation link stays when it belongs to the account, otherwise the session that asked for the change stays. (#323 (öffnet in einem neuen Tab))
  • The authenticator-code lock also applies to account changes that ask for a code, and regenerating recovery codes needs an authenticator or recovery code. IPv4-mapped client addresses count as their IPv4 address for throttling, and a changed email address is reported as in use only after the second factor passed. (#324 (öffnet in einem neuen Tab))
  • A deeply nested model API request is refused with 400 instead of aborting the gateway, which dropped every request and stream of every organization. Bodies nested more than 127 levels deep are refused before any codec parses them. (#326 (öffnet in einem neuen Tab))
  • A request holds its full translation memory estimate only while it is decoded and encoded, and one key can hold at most a quarter of the body_limits.in_flight budget. A request that finds no room within 10 seconds gets 503 with Retry-After: 10, and whitespace no longer counts toward the estimate. (#327 (öffnet in einem neuen Tab))
  • Request bodies have a total read deadline, server.body_read_deadline, 60 seconds by default, so a body sent one byte at a time gets the same 400 as a stalled one. The gateway also caps its connections with server.max_connections, 4096 by default. (#328 (öffnet in einem neuen Tab))
  • The request log's CSV export quotes every text cell and adds an apostrophe in front of values that start a formula or contain a semicolon, pipe or tab. Spreadsheet programs can no longer run a formula from a model name or user agent. (#329 (öffnet in einem neuen Tab))
  • The models catalogue that sets the prices spend budgets use is fetched only over https, or over plain http when the feed is on the local machine. Redirects are followed at most three times and only to the same host over https. (#331 (öffnet in einem neuen Tab))
  • Under a spend budget, a model with no price, or a zero price from the feed, is refused with 403 naming the model instead of counting as free. A price an admin sets by hand, including zero, still counts as set. (#332 (öffnet in einem neuen Tab))
  • Model ids of . and .., and ids with either between slashes, are refused in the codecs and the Platform API. They can no longer change the path of a provider request. (#333 (öffnet in einem neuen Tab))
  • A model a key may not use now answers 404 with the same message as a model that doesn't exist, instead of 403. A restricted key can no longer list a project's catalogue by probing model names. (#334 (öffnet in einem neuen Tab))
  • Release builds no longer restore shared caches or run dependency build scripts while holding publishing credentials. Release notes are checked for install commands, pipes into a shell and instructions to change variables. (#341 (öffnet in einem neuen Tab))
  • The console and the edge run a Caddy built with Go 1.26.9 and x/net 0.60.0, which fix six HTTP/2 vulnerabilities. The edge now runs the console image without the capability to bind privileged ports, and PostgreSQL is pinned to a rebuild with a fixed zlib. (#342 (öffnet in einem neuen Tab))
  • The updater refuses containers that change any security-relevant setting, and its Docker proxy allows bind mounts only from the install's folder. Inspect calls accept only the full or short container id that the updater itself uses. (#343 (öffnet in einem neuen Tab))
  • New installs write their files with a restrictive umask and give master-keys to the gateway's user, so only that user can read it. The edge network has a fixed subnet that the gateway trusts for forwarded addresses, and the edge Caddy runs read-only with its admin API off. This release changes compose.yaml beyond its image versions, so install it by hand, and a reverse proxy of your own is trusted only when named in the trusted proxies setting. (#344 (öffnet in einem neuen Tab))
  • The console refuses sign-in redirects to other hosts, forgets secrets and one-time link tokens once they are used, requires Trusted Types, and updates by hand only after every check passes. (#345 (öffnet in einem neuen Tab))

Gateway

  • A request that touches a session now invalidates its cached entry instead of writing back the row it read, so a revoke, deactivation or demotion takes effect at once instead of lingering for up to 30 seconds. (#322 (öffnet in einem neuen Tab))
  • A key restricted to some models no longer gets every model of its project during a cache invalidation race. The cached access table lists unrestricted keys and service accounts too, an unlisted key gets no models, and the gateway reloads the table once when it meets an unknown key. (#330 (öffnet in einem neuen Tab))

Weitere Releases