Starstruk Logo MarkStarstruk

v0.1.4 backend/v2.5.0

high risk

feder-cr/invisible_dotsMar 2, 2026 → Mar 3, 20261 day between releases

What's New

Newer release appears to be a different package line (Hanko backend v2.5.0) than the older webreel v0.1.4, adding profile attributes, AMR claims, and security fixes.

Breaking Changes

  • The two releases do not belong to the same package or versioning line (webreel@0.1.4 vs backend/v2.5.0), so this is not an in-place upgrade and any tooling pinned to the webreel packages cannot simply bump to this version.
  • Consumers parsing the `/me` response may need to tolerate additional fields if they use strict schema validation.

New Features

  • Users can now store standard OIDC `name` and `picture` attributes, initially sourced from third-party providers like Google and GitHub.
  • Session tokens now carry AMR (Authentication Methods References) claims so relying parties can see how a user authenticated.
  • The `/me` endpoint returns richer user information in a single call, reducing follow-up requests.

Improvements

  • Improved OIDC compatibility and frontend integration ergonomics through standard profile claims.
  • Better auditability and policy enforcement enabled by AMR values in tokens.

Bug Fixes

  • Fixed a SQL injection vulnerability in audit_logs queries by replacing unsafe query construction.
  • Fixed broken security notification webhooks.

Upgrade Notes

First confirm which repository and package you actually depend on, since the newer notes describe the Hanko backend rather than the webreel recorder fixed in v0.1.4. If you do run the backend, prioritize this release for the SQL injection fix and verify that any `/me` consumers accept the expanded payload. Profile name/picture management via the profile element is not yet available and is slated for a later update.

The Two Releases

v0.1.4

v0.1.4

Mar 2, 2026· 8 months ago

A patch release focused on fixing a critical bug where the video recorder would hang indefinitely after completing all steps.

Full release notes
backend/v2.5.0

Hanko 2.5

Mar 3, 2026· 8 months ago

A security-focused release adding user profile attributes, AMR claims to tokens, and extending the `/me` endpoint, plus critical security fixes.

Full release notes