跳到正文

Kaeso 0.3.7。发布于 2026年10月22日，包含 29 项变更。

发布日期
变更
29 项变更
本版本内容
新增、变更、修复和安全
GitHub 上的版本（在新标签页中打开）

Operators need to act on this release: compose.yaml changed beyond its image versions and must be installed by hand, and a reverse proxy of your own is trusted only when it is named in the trusted proxies setting. Single sign-on now starts only after the email, organization sign-in links are removed, and changing or deleting an SSO connection ends the sessions it signed in. The gateway also stops deeply nested requests from crashing it, keeps one key from holding the whole translation memory budget, and refuses unpriced models under a spend budget.

Contributors: @dvnold

Full changes: v0.3.6...v0.3.7（在新标签页中打开）

新增

  • Instance administration can be opened to one organization's single sign-on through a new instance setting, which names that organization or none, the default. An instance admin's session from that provider can then use the instance API while the organization manages the account. Changing the setting still needs a password or sign-in link, and each change is audited as instance.admin_sso_update. (#338（在新标签页中打开）)

Console

  • An organization's Security page says when its identity provider's sign-ins can never count as recent, and GET orgs/{org}/security returns it as sso.sends_auth_time.

变更

  • Prometheus metrics listen on loopback by default instead of on every interface. The gateway image still listens on all interfaces inside its container, which is what the documented port mapping reaches, and Compose publishes the port nowhere. (#335（在新标签页中打开）)
  • A sign-in through the single sign-on of the organization that manages an account now opens all of that person's organizations, and Require single sign-on applies only to those accounts. An organization manages the accounts whose address is at one of its verified domains, and guests keep their own sign-in. (#337（在新标签页中打开）)
  • The identity provider of the organization that manages an account now owns its address. POST me/email is refused for such an account, and a sign-in through that provider replaces the stored address with a newer verified one at a verified domain. An address another account holds is never taken. (#339（在新标签页中打开）)
  • Signing in again from a managed account's single sign-on offers that organization's identity provider first, with the password and an email link beside it. GET me/sign-in-again lists the managing organization first in sso, and a provider that doesn't send auth_time is left out. (#340（在新标签页中打开）)

修复

Console

  • The sign-in-again dialog no longer keeps offering an identity provider that never sends auth_time, such as one run on Clerk. After one failed confirmation it explains why and offers the password or an email link, and a confirmation without auth_time now returns no_auth_time instead of stale_sign_in.
  • Setting up an authenticator app from a single sign-on session asks to sign in another way instead of showing an error whose Try again failed the same way.

UI library

  • A dialog that finishes closing after another dialog opened no longer takes focus from it, so a search typed into a combobox stays and its options remain. (#346（在新标签页中打开）)

安全

  • Single sign-on starts only after the person enters their email, and the organization start link is removed. A planted link can no longer sign a signed-out browser in to another account, and links point to /sign-in instead. (#319（在新标签页中打开）)
  • Deleting an organization's SSO connection, or saving it with a new issuer or client id, ends every session that connection signed in, and the audit entry records sessions_ended. DELETE me/sso-links/{org} likewise ends the account's sessions from that organization's SSO and now needs a recent sign-in. (#320（在新标签页中打开）)
  • Reset links, sign-in links and the link sign-up sends to an existing account go to the account's stored address. Addresses are compared in NFKC-normalized form, so lookalike addresses no longer receive another account's links or dodge its sign-in limits. (#321（在新标签页中打开）)
  • Confirming a new email address now signs out every other session of the account. The session that opens the confirmation link stays when it belongs to the account, otherwise the session that asked for the change stays. (#323（在新标签页中打开）)
  • The authenticator-code lock also applies to account changes that ask for a code, and regenerating recovery codes needs an authenticator or recovery code. IPv4-mapped client addresses count as their IPv4 address for throttling, and a changed email address is reported as in use only after the second factor passed. (#324（在新标签页中打开）)
  • A deeply nested model API request is refused with 400 instead of aborting the gateway, which dropped every request and stream of every organization. Bodies nested more than 127 levels deep are refused before any codec parses them. (#326（在新标签页中打开）)
  • A request holds its full translation memory estimate only while it is decoded and encoded, and one key can hold at most a quarter of the body_limits.in_flight budget. A request that finds no room within 10 seconds gets 503 with Retry-After: 10, and whitespace no longer counts toward the estimate. (#327（在新标签页中打开）)
  • Request bodies have a total read deadline, server.body_read_deadline, 60 seconds by default, so a body sent one byte at a time gets the same 400 as a stalled one. The gateway also caps its connections with server.max_connections, 4096 by default. (#328（在新标签页中打开）)
  • The request log's CSV export quotes every text cell and adds an apostrophe in front of values that start a formula or contain a semicolon, pipe or tab. Spreadsheet programs can no longer run a formula from a model name or user agent. (#329（在新标签页中打开）)
  • The models catalogue that sets the prices spend budgets use is fetched only over https, or over plain http when the feed is on the local machine. Redirects are followed at most three times and only to the same host over https. (#331（在新标签页中打开）)
  • Under a spend budget, a model with no price, or a zero price from the feed, is refused with 403 naming the model instead of counting as free. A price an admin sets by hand, including zero, still counts as set. (#332（在新标签页中打开）)
  • Model ids of . and .., and ids with either between slashes, are refused in the codecs and the Platform API. They can no longer change the path of a provider request. (#333（在新标签页中打开）)
  • A model a key may not use now answers 404 with the same message as a model that doesn't exist, instead of 403. A restricted key can no longer list a project's catalogue by probing model names. (#334（在新标签页中打开）)
  • Release builds no longer restore shared caches or run dependency build scripts while holding publishing credentials. Release notes are checked for install commands, pipes into a shell and instructions to change variables. (#341（在新标签页中打开）)
  • The console and the edge run a Caddy built with Go 1.26.9 and x/net 0.60.0, which fix six HTTP/2 vulnerabilities. The edge now runs the console image without the capability to bind privileged ports, and PostgreSQL is pinned to a rebuild with a fixed zlib. (#342（在新标签页中打开）)
  • The updater refuses containers that change any security-relevant setting, and its Docker proxy allows bind mounts only from the install's folder. Inspect calls accept only the full or short container id that the updater itself uses. (#343（在新标签页中打开）)
  • New installs write their files with a restrictive umask and give master-keys to the gateway's user, so only that user can read it. The edge network has a fixed subnet that the gateway trusts for forwarded addresses, and the edge Caddy runs read-only with its admin API off. This release changes compose.yaml beyond its image versions, so install it by hand, and a reverse proxy of your own is trusted only when named in the trusted proxies setting. (#344（在新标签页中打开）)
  • The console refuses sign-in redirects to other hosts, forgets secrets and one-time link tokens once they are used, requires Trusted Types, and updates by hand only after every check passes. (#345（在新标签页中打开）)

Gateway

  • A request that touches a session now invalidates its cached entry instead of writing back the row it read, so a revoke, deactivation or demotion takes effect at once instead of lingering for up to 30 seconds. (#322（在新标签页中打开）)
  • A key restricted to some models no longer gets every model of its project during a cache invalidation race. The cached access table lists unrestricted keys and service accounts too, an unlisted key gets no models, and the gateway reloads the table once when it meets an unknown key. (#330（在新标签页中打开）)

更多版本