From f39f59e9e0dcf0957c83872e60093cebb90ca596 Mon Sep 17 00:00:00 2001 From: Elias Schneider Date: Fri, 7 Aug 2026 11:21:42 +0200 Subject: [PATCH] release: 2.13.0 --- .version | 2 +- CHANGELOG.md | 47 +++++++++++++++++++++++++++++++++++++++++++ frontend/package.json | 2 +- 3 files changed, 49 insertions(+), 2 deletions(-) diff --git a/.version b/.version index d8b69897..fb2c0766 100644 --- a/.version +++ b/.version @@ -1 +1 @@ -2.12.0 +2.13.0 diff --git a/CHANGELOG.md b/CHANGELOG.md index d270f96c..17341231 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,50 @@ +## v2.13.0 + +### Bug Fixes + +- retry qr code login polling for known transient gateway responses ([7039692](https://github.com/pocket-id/pocket-id/commit/703969278be2a6b2cae30ca89dba4b73b0c969fa) by @stonith404) +- decrease QR code login session duration to 5 minutes ([e35be30](https://github.com/pocket-id/pocket-id/commit/e35be309a3d40064617ef0ad557476c93ba983a9) by @stonith404) +- show more user-friendly error message if QR code has expired ([27199f6](https://github.com/pocket-id/pocket-id/commit/27199f61d4adaeca463db68980dae6c2a885c5b4) by @stonith404) +- one-time-access-token CLI fails with "RuntimePSKs is required" ([#1637](https://github.com/pocket-id/pocket-id/pull/1637) by @salcatroppa) +- session revoke fails if orphaned session tokens exist ([598895e](https://github.com/pocket-id/pocket-id/commit/598895e7c53df28598d578896f6396241e9e9ef7) by @stonith404) +- disable api key auth for webauthn register endpoints ([db64b15](https://github.com/pocket-id/pocket-id/commit/db64b150be9046ee971f520b4c30f3b3d434facf) by @stonith404) +- explicitly set SameSite to Lax for cookies ([69d55ad](https://github.com/pocket-id/pocket-id/commit/69d55ada6c695c47f764285ca9e94736e50a8103) by @stonith404) +- explicitly require JSON for request bodies ([1238bf0](https://github.com/pocket-id/pocket-id/commit/1238bf0f378340d101c90295990b514131b10fe7) by @stonith404) +- don't rely on content length header for optional json binding ([2c7d1b6](https://github.com/pocket-id/pocket-id/commit/2c7d1b63e1a366718d0c1951475e791922bb2445) by @stonith404) +- respect log level in HTTP request logs ([488c50e](https://github.com/pocket-id/pocket-id/commit/488c50ef95e3e88f3a0085a67b399819a4647c7f) by @stonith404) +- don't skip rate limits for loopback addresses ([140b5d3](https://github.com/pocket-id/pocket-id/commit/140b5d3cb440ccc7a30a3a1c9aae2f7a9d5efb4a) by @stonith404) +- make OIDC client token lifetimes optional ([#1650](https://github.com/pocket-id/pocket-id/pull/1650) by @ItalyPaleAle) +- in non-HA mode, increase AlarmLeaseDuration ([#1660](https://github.com/pocket-id/pocket-id/pull/1660) by @ItalyPaleAle) +- separate TLS inputs and preserve certificate reloads ([#1653](https://github.com/pocket-id/pocket-id/pull/1653) by @stonith404) +- brotli compression ignored ([#1661](https://github.com/pocket-id/pocket-id/pull/1661) by @stonith404) +- align last signed in text left ([c87012a](https://github.com/pocket-id/pocket-id/commit/c87012ae01cb9e85ab305fffc40347297eff6ffb) by @stonith404) + +### Features + +- make oauth access tokens RFC 9068 compliant ([7c55bdf](https://github.com/pocket-id/pocket-id/commit/7c55bdf115fc5b7fea89ef5cd3c79dc926ddf5ac) by @stonith404) +- implement OAuth Client ID Metadata Document ([#1526](https://github.com/pocket-id/pocket-id/pull/1526) by @jfroy) +- add ability to customize session duration of clients ([#1641](https://github.com/pocket-id/pocket-id/pull/1641) by @stonith404) +- add observability to actors ([#1646](https://github.com/pocket-id/pocket-id/pull/1646) by @ItalyPaleAle) +- include Francis data in Pocket ID backups ([#1645](https://github.com/pocket-id/pocket-id/pull/1645) by @ItalyPaleAle) +- add settings for limiting what passkeys can be used ([#1662](https://github.com/pocket-id/pocket-id/pull/1662) by @stonith404) + +### Other + +- preserve tab indentation for package.json in release script ([a1ebf4e](https://github.com/pocket-id/pocket-id/commit/a1ebf4e98b65fa465f99bfa2fb9694a903076a32) by @stonith404) +- Bump the "all-dependencies" group with 3 updates across multiple ecosystems ([#1639](https://github.com/pocket-id/pocket-id/pull/1639) by @dependabot[bot]) +- use paraglide markup instead of custom implementation ([b08ac7b](https://github.com/pocket-id/pocket-id/commit/b08ac7bf7de04872a83913db19fc6392ecf7bd96) by @stonith404) +- fix wrong database version in `database.json` ([281bea5](https://github.com/pocket-id/pocket-id/commit/281bea54d351128e29bb2e54455a7cb2e619554a) by @stonith404) +- standardize API error handling ([#1635](https://github.com/pocket-id/pocket-id/pull/1635) by @stonith404) +- add deepsec to gitignore ([e3e0ddc](https://github.com/pocket-id/pocket-id/commit/e3e0ddc192d01de35b8f907144ac66b6b2963ac0) by @stonith404) +- upgrade vulnerable dependencies ([9320144](https://github.com/pocket-id/pocket-id/commit/9320144991fa0f9f6c1419af0c78c7e2395dc61e) by @stonith404) +- remove unused curl dependency from Dockerfile ([98160b2](https://github.com/pocket-id/pocket-id/commit/98160b20a15056535bf12d357b7d97c63a165cd0) by @stonith404) +- remove invalid unit test ([95809dd](https://github.com/pocket-id/pocket-id/commit/95809dd29cea92e30f54c34876305f7a27a595bd) by @stonith404) +- use smaller francis.bin ([4fe6f06](https://github.com/pocket-id/pocket-id/commit/4fe6f0688c2760abfe35558ffc9126f3a1e9edc0) by @stonith404) +- move GeoLite to its own package ([#1647](https://github.com/pocket-id/pocket-id/pull/1647) by @ItalyPaleAle) +- fix formatting ([#1666](https://github.com/pocket-id/pocket-id/pull/1666) by @Copilot) + +**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.12.0...v2.13.0 + ## v2.12.0 ### Bug Fixes diff --git a/frontend/package.json b/frontend/package.json index fff428f5..60f57bbb 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,6 +1,6 @@ { "name": "pocket-id-frontend", - "version": "2.12.0", + "version": "2.13.0", "private": true, "type": "module", "scripts": {