Skip to content

InsForge

v2.0.3 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

ai ai-agents coding deno embeddings insforge
+7 more
nextjs oauth2 pgvector postgresql realtime vectors websockets

Affected surfaces

deps

Summary

AI summary

Block DDL/DML on system schema in raw SQL editor to prevent unauthorized data manipulation.

Full changelog

What's Changed

  • fix(shared-schemas): add .js extensions for ESM/Deno compat by @tonychang04 in https://github.com/InsForge/InsForge/pull/1030
  • fix: patch path-to-regexp CVE-2026-4867 by @jwfing in https://github.com/InsForge/InsForge/pull/1033
  • Bump frontend TypeScript lib to ES2022 by @tonychang04 in https://github.com/InsForge/InsForge/pull/1035
  • fix: bake postgres config into image for Coolify deployment by @cousined1 in https://github.com/InsForge/InsForge/pull/1014
  • Fix functions architecture docs for dual runtime by @tonychang04 in https://github.com/InsForge/InsForge/pull/1037
  • fix(docker): enable multiple instances by removing container_name and… by @NSTKrishna in https://github.com/InsForge/InsForge/pull/1038
  • fix(security): block DDL/DML on system schema in raw SQL editor by @Davidson3556 in https://github.com/InsForge/InsForge/pull/1041
  • fix(docker): enable multiple instances on same host by @tonychang04 in https://github.com/InsForge/InsForge/pull/1042
  • fix(ai): return actionable error for BYOK key failures instead of generic 500 by @claygeo in https://github.com/InsForge/InsForge/pull/1046
  • fix(dashboard): make Getting Started panel scrollable to reveal hidden steps by @claygeo in https://github.com/InsForge/InsForge/pull/1047
  • fix(docker): resolve EACCES permission errors in dev container by @claygeo in https://github.com/InsForge/InsForge/pull/1049
  • Dashboard Migration by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1029
  • fix(backend): add column type map caching to improve performance by @soumojit-D48 in https://github.com/InsForge/InsForge/pull/1045
  • feat(auth): add auto-confirm option when creating users from dashboard by @claygeo in https://github.com/InsForge/InsForge/pull/1048
  • fix: patch lodash CVE-2026-4800 and remove release-it by @jwfing in https://github.com/InsForge/InsForge/pull/1058
  • docs: add Deployment & Security Guide for VPS installation (#866) by @Davidson3556 in https://github.com/InsForge/InsForge/pull/1056
  • fix: invalidate column type cache on raw SQL and import routes by @jwfing in https://github.com/InsForge/InsForge/pull/1054
  • fix: set default STORAGE_DIR/LOGS_DIR in Dockerfile to prevent data loss on pod restart by @tonychang04 in https://github.com/InsForge/InsForge/pull/1055
  • Dashboard optimize Step I by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1066
  • Revert back to iframe solution for cloud-hosting by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1071
  • fix(docs): update functions docs at correct Mintlify path by @tonychang04 in https://github.com/InsForge/InsForge/pull/1074
  • seed jwtsecret by @CarmenDou in https://github.com/InsForge/InsForge/pull/1072
  • feat: custom SMTP provider and email template editor by @tonychang04 in https://github.com/InsForge/InsForge/pull/921
  • feat: adopt Turborepo for monorepo task orchestration by @claygeo in https://github.com/InsForge/InsForge/pull/1068
  • Optimize dashboard authentication flow by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1078
  • BUG(backend): make Express body limits configurable via environment variables by @prakharsingh-74 in https://github.com/InsForge/InsForge/pull/1079
  • fix: patch vite, nodemailer, and axios security vulnerabilities by @jwfing in https://github.com/InsForge/InsForge/pull/1084
  • Fix Connect dialog not opening in cloud by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1085

New Contributors

  • @cousined1 made their first contribution in https://github.com/InsForge/InsForge/pull/1014
  • @claygeo made their first contribution in https://github.com/InsForge/InsForge/pull/1046
  • @soumojit-D48 made their first contribution in https://github.com/InsForge/InsForge/pull/1045

Full Changelog: https://github.com/InsForge/InsForge/compare/v2.0.2...v2.0.3

Security Fixes

  • CVE-2026-4867 — patch path-to-regexp security vulnerability
  • CVE-2026-4800 — patch lodash security vulnerability
  • Patch vite, nodemailer, and axios security vulnerabilities (specific CVE IDs not listed)
  • Block DDL/DML on system schema in raw SQL editor

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track InsForge

Get notified when new releases ship.

Sign up free

About InsForge

All releases →

Related context

Earlier breaking changes

  • v2.1.8 Restricts raw SQL permission to project_admin role only.

Beta — feedback welcome: [email protected]