This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+2 more
Affected surfaces
Summary
AI summaryNew APIs expose repository and S3 credential details when include_secrets=1 and token capability controls access.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Logs each call with `include_secrets=1` on `/api/v1/repositories` for audit. Logs each call with `include_secrets=1` on `/api/v1/repositories` for audit. Source: granite4.1:30b@2026-05-27-audit Confidence: low |
— |
| Feature | Low |
Adds `GET /api/v1/repositories` endpoint to list all repositories across clients. Adds `GET /api/v1/repositories` endpoint to list all repositories across clients. Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Feature | Low |
Adds `GET /api/v1/s3-credentials` endpoint with optional secret inclusion. Adds `GET /api/v1/s3-credentials` endpoint with optional secret inclusion. Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Feature | Low |
Introduces "Display Secrets" token capability for API tokens. Introduces "Display Secrets" token capability for API tokens. Source: llm_adapter@2026-05-27 Confidence: low |
— |
| Feature | Low |
Allows optional inclusion of decrypted passphrases via `?include_secrets=1` on `/api/v1/repositories`. Allows optional inclusion of decrypted passphrases via `?include_secrets=1` on `/api/v1/repositories`. Source: granite4.1:30b@2026-05-27-audit Confidence: low |
— |
| Feature | Low |
Allows optional inclusion of S3 access/secret keys via `?include_secrets=1` on `/api/v1/s3-credentials`. Allows optional inclusion of S3 access/secret keys via `?include_secrets=1` on `/api/v1/s3-credentials`. Source: granite4.1:30b@2026-05-27-audit Confidence: low |
— |
| Bugfix | Medium |
Repository Repair no longer aborts with 'Cancelled by user' when missing stdin confirmation. Repository Repair no longer aborts with 'Cancelled by user' when missing stdin confirmation. Source: llm_adapter@2026-05-27 Confidence: high |
— |
Full changelog
Fixes
- Repository Repair no longer aborts with 'Cancelled by user' (#295) —
borg check --repairprompts for a literal 'YES' on stdin before running, and the server-side repair job wasn't supplying it. Now setsBORG_CHECK_I_KNOW_WHAT_I_AM_DOING=YESon both the local and remote-SSH borg paths.
New API
GET /api/v1/repositories— list every repository across every client in one response. Pass?include_secrets=1to also return the decrypted passphrase per repo (for escrow / disaster-recovery exports). Each call withinclude_secrets=1is logged toserver_logfor audit (#289).GET /api/v1/s3-credentialsnow follows the same pattern: returns endpoint / region / bucket / path_prefix by default; add?include_secrets=1to also get the access key and secret key.- Token capability: Display Secrets — Settings → API → Create Token has a new checkbox. Only tokens with the capability can pass
?include_secrets=1on either endpoint; everything else gets HTTP 403. Existing tokens default to no-secrets, so this is a strictly additive permission.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]