v4.5.0
FujiwaraChoki/MoneyPrinterV2v4.5.0Sep 16, 2026by github-actions[bot]
Upgrading?
AI Summary
This release focuses on UI enhancements for group management and significant security hardening, including OAuth state encoding, role and permission imports, and strict resource scoping.
Key Highlights
- Group tree page actions for add/delete groups
- Popup mode support for Captcha providers
- URL-encoding OAuth state on interactive login
- Allow org admins to import groups, roles, and permissions via xlsx
- Strict scoping of tokens, credentials, and resources to the caller's organization
New Features
- Add group add/delete actions to group tree page
- Support popup mode for Captcha providers
Full Release Notes
## Changelog ### Features * fb38eaea363ba8a17818d751950beecd9b1ee5ff feat: add group add/delete actions to group tree page * 39a1bba16e8be5cf8169156dc7a04fdf9af73865 feat: support popup mode for Captcha providers ### Bug fixes * 0f629ebed9727b191e259d82a9ed16871abc67fa fix: URL-encode OAuth state on interactive login, consent, prompt, signup and post-logout redirects * 1d654279a18654498568891512f9ef088a2da7be fix: allow only global admins to change applications' custom HTML * f82480a870523f1848b956dbec98c44b31c9240d fix: allow org admins to import groups, roles and permissions via xlsx * 15e3c21022c15bc3ab4bfe5e7998bc28615e3573 fix: authorize get-permissions-by-submitter against the signed-in user * d484bf5482a7edba9520acc5b486d54a84b10103 fix: bind token exchange to the audience and organization of the target application * f88e92c7a94eab9485356cb331e609085accd5b3 fix: block intranet addresses in non-built-in organizations' webhooks * d8c06ad2dfcdd9fcf0824a6cf655312022f50fee fix: check token revocation in token exchange, enforce MFA and verified email when binding social logins * 1f4e299139c11b329ebb9ad95a30fe369aa7096c fix: enforce SAML audience, validity window, InResponseTo and replay protection in SP * 4c27d13aa967e6c9a06ebc3932346f122a23eb63 fix: index token by organization and user to speed up forbidding a user * 7fc8c7f0629b3c864aabf9846108a693387ff5a6 fix: mask global cert private keys from org admins * 322f84dfae707da14419d694e5c813d2b44c8931 fix: move password history out of user table to avoid MySQL row size limit * cd938de690e4863f28457057d6d3b6debf3a1dc3 fix: restore Edit LDAP, organization transactions and MCP Store buttons missing from the new frontend * 6a99ac745ba126b421bc7fd52a45a0c4b3fe0862 fix: restrict email, SMS and notification providers to the caller's organization * 0af4692074a456bbcb7a8f5a622a9f7ad0daf7fc fix: restrict resource storage providers and file paths to the caller's organization and user * f81531b99b886e2fbb1be60086d21d3f6a368b0e fix: scope application credentials to their own organization * 47558d31dc76ecac450666dc306245d8b5267028 fix: scope get-resources to the caller and restrict direct listing to admins * 0aafb57c7f1a4f2b72689ef56aeb34fbd6b7b48a fix: scope rename triggers to their own organization * 58aa959dd779ded14038885c61d123611ee2eef4 fix: scope user rename to the user's own organization
Related Repositories
public-apis/public-apis★ 491,148
A collective list of free APIs
NousResearch/hermes-agent★ 255,992
The agent that grows with you
yt-dlp/yt-dlp★ 200,099
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,501
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,704
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.