@sveltejs/kit@3.0.1 v0.2.14
Wei-Shaw/sub2apiOct 6, 2026 → Oct 7, 20261 day between releases
What's New
v0.2.14 introduces critical security fixes for default credentials and EasyPay callback forgery.
Breaking Changes
- New installations fail if ADMIN_PASSWORD is less than 8 bytes, more than 72 bytes, or ADMIN_EMAIL is invalid.
- Admin login email changed from admin@sub2api.local to a random string in new installations.
New Features
- Implemented random admin email generation for new installations.
- Enforced strict password length (8-72 bytes) and email format validation.
- Callback verification now rejects non-standard notification parameters to prevent forgery.
Improvements
- Fixed security vulnerability allowing EasyPay callback forgery without merchant key.
- Fixed remote Codex model directory discovery missing api_key_model_discovery configuration.
Bug Fixes
- Fixed default admin email being fixed as admin@sub2api.local without password strength validation.
- Fixed EasyPay signature replay vulnerability allowing forgery without merchant key.
- Fixed Codex configuration generation for remote models.
Upgrade Notes
Existing instances require no changes, but users relying on the old default email should update credentials in the backend. Ensure ADMIN_PASSWORD is set correctly during new installations to avoid failure.
The Two Releases
@sveltejs/kit@3.0.1
Oct 6, 2026· 16 days ago
Minimal release notes: "### Patch Changes - fix: ensure relative imports in generated types work with `nodenext` module resolution ([#17351](ht"
Full release notesSub2API 0.2.14
Oct 7, 2026· 15 days ago
This release focuses on critical security improvements, specifically addressing default admin credentials and a payment callback forgery vulnerability in EasyPay.
Full release notes