v0.64.3 v2.0.9-beta
high risk
zarazhangrui/frontend-slidesSep 25, 2026 → Sep 25, 20260 days between releases
What's New
Major version jump introduces security hardening and database configuration updates.
Breaking Changes
- SQLite shared cache (`cache=shared`) removed to prevent table-lock conflicts.
- Login redirects must be same-app relative paths to prevent open redirects.
- Signup now sends credentials in JSON body instead of query parameters.
New Features
- Fresh installs now generate a random initial password instead of `admin`/`admin`.
- OIDC login binds OAuth state to an HttpOnly cookie for enhanced security.
- SSRF gap closed in OnlyOffice integration.
- Session/API token registrations now record JWT expiry for automatic pruning.
Improvements
- General security hardening across login, logout, and session expiry flows.
- Database configuration updates utilizing WAL mode for concurrent readers.
- Session management improvements with stricter token validation.
Bug Fixes
- Fixed token migration lockout regression from v2.0.8-beta.
- Fixed CSP hardening causing intermittent blank pages.
- Fixed ffmpeg unresponsive lock issue.
- Public shares with OnlyOffice disabled now reject `/office/config` requests server-side.
Upgrade Notes
Update database connection strings to remove `cache=shared` and switch to WAL mode. Update login redirect URLs to be relative paths and modify signup API calls to use JSON body.
The Two Releases
v0.64.3
OpenHuman v0.64.3
Sep 25, 2026· 26 days ago
Improves reliability, speed, and observability with enhancements to agent stability, chat recovery, and integrations.
Full release notesv2.0.9-beta
v2.0.9-beta
Sep 25, 2026· 26 days ago
Security and stability updates including login hardening, bug fixes, and configuration changes for the database.
Full release notes