This release includes 4 security fixes for security teams reviewing exposed deployments.
Published 1mo
AI Agents & Assistants
✓ No known CVEs patched
This release patches 4 known CVEs
Topics
ai
ai-agents
coding
deno
embeddings
insforge
+7 more
nextjs
oauth2
pgvector
postgresql
realtime
vectors
websockets
Affected surfaces
deps
Summary
AI summaryBlock DDL/DML on system schema in raw SQL editor to prevent unauthorized data manipulation.
Full changelog
What's Changed
- fix(shared-schemas): add .js extensions for ESM/Deno compat by @tonychang04 in https://github.com/InsForge/InsForge/pull/1030
- fix: patch path-to-regexp CVE-2026-4867 by @jwfing in https://github.com/InsForge/InsForge/pull/1033
- Bump frontend TypeScript lib to ES2022 by @tonychang04 in https://github.com/InsForge/InsForge/pull/1035
- fix: bake postgres config into image for Coolify deployment by @cousined1 in https://github.com/InsForge/InsForge/pull/1014
- Fix functions architecture docs for dual runtime by @tonychang04 in https://github.com/InsForge/InsForge/pull/1037
- fix(docker): enable multiple instances by removing container_name and… by @NSTKrishna in https://github.com/InsForge/InsForge/pull/1038
- fix(security): block DDL/DML on system schema in raw SQL editor by @Davidson3556 in https://github.com/InsForge/InsForge/pull/1041
- fix(docker): enable multiple instances on same host by @tonychang04 in https://github.com/InsForge/InsForge/pull/1042
- fix(ai): return actionable error for BYOK key failures instead of generic 500 by @claygeo in https://github.com/InsForge/InsForge/pull/1046
- fix(dashboard): make Getting Started panel scrollable to reveal hidden steps by @claygeo in https://github.com/InsForge/InsForge/pull/1047
- fix(docker): resolve EACCES permission errors in dev container by @claygeo in https://github.com/InsForge/InsForge/pull/1049
- Dashboard Migration by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1029
- fix(backend): add column type map caching to improve performance by @soumojit-D48 in https://github.com/InsForge/InsForge/pull/1045
- feat(auth): add auto-confirm option when creating users from dashboard by @claygeo in https://github.com/InsForge/InsForge/pull/1048
- fix: patch lodash CVE-2026-4800 and remove release-it by @jwfing in https://github.com/InsForge/InsForge/pull/1058
- docs: add Deployment & Security Guide for VPS installation (#866) by @Davidson3556 in https://github.com/InsForge/InsForge/pull/1056
- fix: invalidate column type cache on raw SQL and import routes by @jwfing in https://github.com/InsForge/InsForge/pull/1054
- fix: set default STORAGE_DIR/LOGS_DIR in Dockerfile to prevent data loss on pod restart by @tonychang04 in https://github.com/InsForge/InsForge/pull/1055
- Dashboard optimize Step I by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1066
- Revert back to iframe solution for cloud-hosting by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1071
- fix(docs): update functions docs at correct Mintlify path by @tonychang04 in https://github.com/InsForge/InsForge/pull/1074
- seed jwtsecret by @CarmenDou in https://github.com/InsForge/InsForge/pull/1072
- feat: custom SMTP provider and email template editor by @tonychang04 in https://github.com/InsForge/InsForge/pull/921
- feat: adopt Turborepo for monorepo task orchestration by @claygeo in https://github.com/InsForge/InsForge/pull/1068
- Optimize dashboard authentication flow by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1078
- BUG(backend): make Express body limits configurable via environment variables by @prakharsingh-74 in https://github.com/InsForge/InsForge/pull/1079
- fix: patch vite, nodemailer, and axios security vulnerabilities by @jwfing in https://github.com/InsForge/InsForge/pull/1084
- Fix Connect dialog not opening in cloud by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1085
New Contributors
- @cousined1 made their first contribution in https://github.com/InsForge/InsForge/pull/1014
- @claygeo made their first contribution in https://github.com/InsForge/InsForge/pull/1046
- @soumojit-D48 made their first contribution in https://github.com/InsForge/InsForge/pull/1045
Full Changelog: https://github.com/InsForge/InsForge/compare/v2.0.2...v2.0.3
Security Fixes
- CVE-2026-4867 — patch path-to-regexp security vulnerability
- CVE-2026-4800 — patch lodash security vulnerability
- Patch vite, nodemailer, and axios security vulnerabilities (specific CVE IDs not listed)
- Block DDL/DML on system schema in raw SQL editor
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About InsForge
All releases →Related context
Earlier breaking changes
- v2.1.8 Restricts raw SQL permission to project_admin role only.
Beta — feedback welcome: [email protected]