Skip to content

InsForge

v2.2.7 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agents coding deno embeddings insforge
+7 more
nextjs oauth2 pgvector postgresql realtime vectors websockets

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Fixed XSS in storage, improved compute scaling options, enhanced realtime documentation and reconnection handling, added batch delete for storage objects, introduced Explain tab in database editor, and upgraded dependencies.

Full changelog

What's Changed

  • chore(deploy): point Zeabur template insforge-oss image at latest by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1634
  • INS-435: oss backend advisor remove false positive for secdef by @CarmenDou in https://github.com/InsForge/InsForge/pull/1636
  • fix(email): reject anonymous clients from send-raw by @Davidson3556 in https://github.com/InsForge/InsForge/pull/1629
  • fix(storage): enforce magic-byte MIME validation to prevent stored XSS by @Sudarshan25092007 in https://github.com/InsForge/InsForge/pull/1626
  • fix(realtime): in-band socket re-auth and presence reconnect docs by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1635
  • feat(compute): add scaleToZero opt-out for always-on services by @tonychang04 in https://github.com/InsForge/InsForge/pull/1638
  • fix(secrets): revive soft-deleted secrets on create instead of failing with 23505 by @tonychang04 in https://github.com/InsForge/InsForge/pull/1643
  • fix(compute): heal stale service rows when the backing machine is gone by @tonychang04 in https://github.com/InsForge/InsForge/pull/1641
  • fix(build): inline file-type into the server bundle so it resolves at runtime by @CarmenDou in https://github.com/InsForge/InsForge/pull/1651
  • Audit SEO metadata: TypeScript realtime SDK page by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1637
  • Implement batch delete functionality for storage objects by @chandranilbakshi in https://github.com/InsForge/InsForge/pull/1627
  • chore(realtime): remove in-band socket reauth by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1653
  • INS-429: Whitelist/remove security issues by @CarmenDou in https://github.com/InsForge/InsForge/pull/1649
  • docs: add comparison and pricing FAQ pages by @CarmenDou in https://github.com/InsForge/InsForge/pull/1652
  • Apply style guide: sentence-case headings across SDK and examples pages by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1645
  • Fix grammar & typos: SDK overviews and MCP setup by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1663
  • test(dashboard): fix UserFormDialog test timeout in full suite by @ayaangazali in https://github.com/InsForge/InsForge/pull/1644
  • Apply style guide: sentence case H3s in mcp-setup by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1666
  • Audit SEO metadata: rewrite titles and descriptions for SDK pages by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1662
  • fix: remove hard min-width from page headers so search stays visible in narrow views by @CarmenDou in https://github.com/InsForge/InsForge/pull/1665
  • Fix grammar & typos: straight quotes in mcp-setup by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1667
  • Audit SEO metadata: improve mcp-setup title by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1669
  • Fix grammar & typos: mcp-setup Trae credentials step by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1670
  • docs: add referral program by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1664
  • Audit SEO metadata: referral program page by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1671
  • docs: add database backups page by @tonychang04 in https://github.com/InsForge/InsForge/pull/1675
  • Audit SEO metadata: database backups page by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1676
  • docs: add Backup & Restore UI screenshot to backups page by @tonychang04 in https://github.com/InsForge/InsForge/pull/1677
  • docs: add web scraper overview page by @CarmenDou in https://github.com/InsForge/InsForge/pull/1672
  • Audit SEO metadata: Web Scraper overview page by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1678
  • Apply style guide: tighten sentences and normalize quotes in mcp-setup by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1668
  • Fix grammar & typos: mcp-setup and backups punctuation by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1681
  • docs(partnership): document white-label upgrade + restart endpoints by @jwfing in https://github.com/InsForge/InsForge/pull/1684
  • docs: relocate internal plan/spec files out of public docs tree by @ayaangazali in https://github.com/InsForge/InsForge/pull/1673
  • feat(database): Add Explain tab to SQL Editor by @prakharsingh-74 in https://github.com/InsForge/InsForge/pull/1639
  • Audit SEO metadata: expand partnership page description by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1687
  • fix(backend): raise HTTP keep-alive timeout above LB idle timeouts by @ayaangazali in https://github.com/InsForge/InsForge/pull/1661
  • fix(auth): implement constant-time comparison for admin login (CWE-208) by @Sudarshan25092007 in https://github.com/InsForge/InsForge/pull/1660
  • feat(shared-schemas): type presence member events by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1656
  • Document project upgrade and deletion in CLI harness docs by @CarmenDou in https://github.com/InsForge/InsForge/pull/1698
  • feat(dashboard): add auto-confirm description in add user dialog by @CarmenDou in https://github.com/InsForge/InsForge/pull/1700
  • docs: list built-in secrets and where to find API keys by @CarmenDou in https://github.com/InsForge/InsForge/pull/1699
  • Apply style guide: tighten schedules keep-alive section by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1696
  • Apply style guide: split long sentence in schedules keep-alive by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1704
  • Docs i18n: 简中 / 繁中 / Español (Mintlify) by @tonychang04 in https://github.com/InsForge/InsForge/pull/1693
  • Audit SEO metadata: expand schedules description by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1695
  • Backend part of the CSRF validation for browser sessions by @chandranilbakshi in https://github.com/InsForge/InsForge/pull/1613
  • docs: distinguish deploying your app (Sites) from self-hosting InsForge by @CarmenDou in https://github.com/InsForge/InsForge/pull/1710
  • fix: prevent Model Gateway credential errors from logging out admins by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1713
  • docs: add FAQ with database vs edge function vs custom compute comparison by @CarmenDou in https://github.com/InsForge/InsForge/pull/1716
  • refactor(storage): stop exporting batch-delete constants from shared-schemas by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1715
  • refactor(auth): dedupe logout CSRF guard and use FORBIDDEN error code by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1711
  • docs: FAQ entries for project pausing and restart by @CarmenDou in https://github.com/InsForge/InsForge/pull/1718
  • docs: FAQ entry on inviting another admin / teammate by @CarmenDou in https://github.com/InsForge/InsForge/pull/1717
  • docs: add auth provider integration guides by @CarmenDou in https://github.com/InsForge/InsForge/pull/1709
  • docs: add FAQ on browserless CLI authentication by @CarmenDou in https://github.com/InsForge/InsForge/pull/1720
  • docs: add FAQ on querying tables in a non-public schema by @CarmenDou in https://github.com/InsForge/InsForge/pull/1722
  • docs(openapi): add missing endpoints across auth, secrets, storage, a… by @bowale01 in https://github.com/InsForge/InsForge/pull/1690
  • Fix grammar & typos: close unterminated code fence in REST database docs by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1705
  • docs: explain FLY_API_TOKEN for self-hosted compute by @CarmenDou in https://github.com/InsForge/InsForge/pull/1724
  • docs: document default email sender domain by @CarmenDou in https://github.com/InsForge/InsForge/pull/1725
  • docs: warn that self-hosted email requires SMTP setup by @CarmenDou in https://github.com/InsForge/InsForge/pull/1723
  • Fix grammar & typos: Spanish auth and SMTP docs by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1726
  • docs: add FAQ on the service_role-equivalent API key for server-side RLS bypass by @CarmenDou in https://github.com/InsForge/InsForge/pull/1727
  • docs(mcp): add MCP server tool capability table by @CarmenDou in https://github.com/InsForge/InsForge/pull/1728
  • Fix grammar & typos: use full-width quotes in zh FAQ by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1729
  • Language selector in dashboard, synced with cloud account locale by @tonychang04 in https://github.com/InsForge/InsForge/pull/1658
  • docs: FAQ on using the CLI for project-specific issues by @CarmenDou in https://github.com/InsForge/InsForge/pull/1730
  • docs: fix blue light-theme logo + Vale vocabulary by @CarmenDou in https://github.com/InsForge/InsForge/pull/1741
  • docs: document querying non-public schemas from the SDK via .schema() by @CarmenDou in https://github.com/InsForge/InsForge/pull/1751
  • Fix SEO issues: expand FAQ titles and descriptions across locales by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1752
  • fix(database): broadcast realtime events for PATCH and PUT by @Twix1288 in https://github.com/InsForge/InsForge/pull/1738
  • fix: remediate Vanta dependency advisories by @jwfing in https://github.com/InsForge/InsForge/pull/1759
  • fix: upgrade axios for Vanta advisories by @jwfing in https://github.com/InsForge/InsForge/pull/1762
  • feat: add Model Gateway usage analytics by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1761
  • 2026-07-13 fix mintlify docs by @CarmenDou in https://github.com/InsForge/InsForge/pull/1765
  • Fix grammar & typos: consistent Chinese quotes in zh FAQ by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1767
  • Fix SEO issues: shorten zh and zh-Hant FAQ metadata by @mintlify[bot] in https://github.com/InsForge/InsForge/pull/1768
  • fix(ai): accept assistant tool-call messages that omit content by @hassaanch23 in https://github.com/InsForge/InsForge/pull/1749
  • fix(ai): report token usage for streaming chat completions by @hassaanch23 in https://github.com/InsForge/InsForge/pull/1740
  • docs: fix readme clone folder case by @ben564885 in https://github.com/InsForge/InsForge/pull/1688
  • feat(storage): use standard PUT replacement semantics by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1760
  • 2026-07-15 fix mintlify docs by @CarmenDou in https://github.com/InsForge/InsForge/pull/1769
  • chore: bump version to 2.2.7 by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1773
  • fix(build): stop bundling file-type to fix "Dynamic require of tty" prod crash by @Fermionic-Lyu in https://github.com/InsForge/InsForge/pull/1774

New Contributors

  • @ayaangazali made their first contribution in https://github.com/InsForge/InsForge/pull/1644
  • @bowale01 made their first contribution in https://github.com/InsForge/InsForge/pull/1690
  • @Twix1288 made their first contribution in https://github.com/InsForge/InsForge/pull/1738
  • @hassaanch23 made their first contribution in https://github.com/InsForge/InsForge/pull/1749
  • @ben564885 made their first contribution in https://github.com/InsForge/InsForge/pull/1688

Full Changelog: https://github.com/InsForge/InsForge/compare/v2.2.6...v2.2.7

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track InsForge

Get notified when new releases ship.

Sign up free

About InsForge

All releases →

Related context

Earlier breaking changes

  • v2.2.0 Rename public‑facing Deployment terminology to Sites.
  • v2.1.8 Restricts raw SQL permission to project_admin role only.

Beta — feedback welcome: [email protected]