v2.0.8-beta v2.0.9-beta
longbridge/gpui-kitSep 21, 2026 → Sep 25, 20264 days between releases
What's New
Security hardening includes random admin passwords and SQLite cache removal.
Breaking Changes
- SQLite `cache=shared` removed from DB connection string
- Default admin credentials changed to random
- OIDC login binds state to HttpOnly cookies
- Public share OnlyOffice endpoints now rejected server-side
New Features
- Random initial password generation
- OIDC state binding to HttpOnly cookies
- Prevention of open redirects in login/signup
- OnlyOffice server-side request validation
- Session/API token JWT expiry tracking
Improvements
- SQLite busy_timeout handling and index write reporting
- Session/API token expiry pruning at startup
- WebDAV ignores user preference for hidden files
Bug Fixes
- Fixed token migration lockout regression from v2.0.8
- FFmpeg unresponsive lock issue
- Intermittent blank page after CSP hardening
- Public share OnlyOffice requests rejected when disabled
Upgrade Notes
Remove `cache=shared` from database connection string. Update default admin credentials after installation. Ensure OIDC redirects are same-app relative paths.
The Two Releases
v2.0.8-beta
Sep 21, 2026· 1 month ago
This beta release prioritizes security fixes, specifically addressing a critical JWT vulnerability and enhancing OnlyOffice callback verification. It introduces a new upload conflict resolution option and improves API error handling by returning appropriate HTTP status codes.
Full release notesv2.0.9-beta
Sep 25, 2026· 26 days ago
This release focuses on security hardening, including random admin passwords and secure OIDC cookie handling, alongside bug fixes for database locking, OnlyOffice interactions, and session management.
Full release notes