v0.2.5

ChatbotXIO/ChatbotXv0.2.5May 19, 2026by realcodesiman

Upgrading?

Release notes summary

A critical update introducing AES-256-GCM encryption for provider credentials stored in a new database table. This change requires specific configuration steps for self-hosted deployments.

Key Highlights

  • Credentials (WhatsApp, Messenger, etc.) now encrypted at rest using AES-256-GCM
  • New `OrganizationCredential` table replaces plaintext storage
  • Requires `ENCRYPTION_KEY` environment variable
  • Database migration and credential backfill scripts provided

Breaking Changes

  • Credentials are moved from plaintext `Organization.settings` to a new `OrganizationCredential` table using AES-256-GCM encryption. This requires adding the `ENCRYPTION_KEY` environment variable, running the database migration, and executing the credential backfill script.

New Features

  • Connect to human function
  • AI function edit/duplicate/delete
  • Misc workspace token APIs
  • AI text success/error handling

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at main -->

  ## What's Changed

  ### 💥 Breaking Changes

  #### feat!: add encryption for auth — [#433](https://github.com/ChatbotXIO/ChatbotX/pull/433) by @realcodesiman

  Provider credentials (WhatsApp, Messenger, Instagram, Google, Zalo, Stripe, Giphy) are now encrypted at rest using
  **AES-256-GCM** and stored in a new `OrganizationCredential` table instead of plaintext in `Organization.settings`.

  **Action required for all self-hosted deployments:**

  **1. Add `ENCRYPTION_KEY` to your environment** (required — app will fail to start without it):
  ```bash
  ENCRYPTION_KEY=$(openssl rand -hex 32)
  ```

  **2. Run the database migration:**
  ```bash
  pnpm --filter @chatbotx.io/database db:migrate
  ```

  **3. Run the credential backfill** (migrates existing plaintext credentials to encrypted storage):
  ```bash
  pnpm --filter @chatbotx.io/database backfill:organization-credentials
  ```

  > The backfill is idempotent and safe to re-run. After it completes, credentials are **removed from the legacy 
  `Organization.settings` column** — there is no rollback path without a database restore.

  **Key rotation** (future use — changing `ENCRYPTION_KEY`):
  ```bash
  ENCRYPTION_KEY_PREV=<old-key>  # set temporarily during rotation only
  ENCRYPTION_KEY=<new-key>
  pnpm --filter @chatbotx.io/database rotate:encryption-key
  # then remove ENCRYPTION_KEY_PREV from env
  ```

  ---

  ### ✨ New Features
  * feat: add function connect to human by @nguyenvantruc92 in https://github.com/ChatbotXIO/ChatbotX/pull/367
  * feat: ai function add feature edit/duplicate and delete by @nguyenvantruc92 in 
  https://github.com/ChatbotXIO/ChatbotX/pull/389
  * feat(api/v1): add misc workspace token APIs (error-logs, whatsapp-templates, inbox-teams) by @realcodesiman in 
  https://github.com/ChatbotXIO/ChatbotX/pull/445
  * feat: ai text add handle succes, error by @nguyenvantruc92 in https://github.com/ChatbotXIO/ChatbotX/pull/390

  ### 🐛 Bug Fixes
  * fix: drizzel snapshot by @sunghajung43 in https://github.com/ChatbotXIO/ChatbotX/pull/460

  ### ⚡ Improvements
  * refactor: extract bot-field and folder business logic to service layer by @realcodesiman in 
  https://github.com/ChatbotXIO/ChatbotX/pull/443


  **Changelog**: https://github.com/ChatbotXIO/ChatbotX/compare/v0.2.4...v0.2.5

Related Repositories