This release adds 4 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
ReleasePort's take
Light signalThe installer now passes ADMIN_PASSWORD to the auth container during its initial boot.
Why it matters: Patch to v0.1.0-alpha.167 immediately if you rely on secure password propagation at first‑boot; this change corrects a critical authentication credential leak.
Summary
AI summaryInstaller now passes ADMIN_PASSWORD to the auth container on first boot.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Migrates from nixopus/agent to api. Migrates from nixopus/agent to api. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Schedules tasks in agent. Schedules tasks in agent. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Adds pino-style JSON logs to api. Adds pino-style JSON logs to api. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Unifies error envelope, adds security headers and trace request_id in api. Unifies error envelope, adds security headers and trace request_id in api. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Adds credits API and billing agent. Adds credits API and billing agent. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Installs transcript and nixopus report. Installs transcript and nixopus report. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Introduces structured logging across API stack. Introduces structured logging across API stack. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Adds security headers to next.config.ts in view. Adds security headers to next.config.ts in view. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Adds error boundaries to view. Adds error boundaries to view. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Adds route-level loading Suspense fallbacks in view. Adds route-level loading Suspense fallbacks in view. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Adds Million.js compiler to view. Adds Million.js compiler to view. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Integrates Million.js compiler into view for rendering performance. Integrates Million.js compiler into view for rendering performance. Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Medium |
Comprehensive CSP and permissions policy fixes. Comprehensive CSP and permissions policy fixes. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Passes ADMIN_PASSWORD to auth container on first boot. Passes ADMIN_PASSWORD to auth container on first boot. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Piped install access URL & provider log. Piped install access URL & provider log. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Always verifies session on auth init. Always verifies session on auth init. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Updates yarn lock file. Updates yarn lock file. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Always verifies session on authentication initialization. Always verifies session on authentication initialization. Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
Full changelog
Bug Fixes
- csp: comprehensive CSP and permissions policy fixes (e7e2678)
- installer: pass ADMIN_PASSWORD to auth container on first boot (#1342) (5cc6211)
- installer: piped install access URL & provider log (#1316) (4037588)
- view: always verify session on auth init (#1337) (522b3d1), closes #1338
- view: update yarn lock file (a786883)
Features
- agent: migrate from nixopus/agent to api (#1336) (b62d098)
- agent: schedules tasks (#1339) (78977cd)
- api: pino-style JSON logs (#1318) (22edab8)
- api: unify error envelope, add security headers, trace request_id (#1326) (012ce95)
- billing: add credits API and billing agent (#1340) (d9f5011)
- installer: install transcript and nixopus report (#1317) (f89b804)
- structured logging across API stack (#1314) (#1315) (67732b3)
- view: add error boundaries (#1327) (809ad35)
- view: add route-level loading.tsx Suspense fallbacks (#1328) (5df8a6c)
- view: add security headers to next.config.ts (#1329) (c250cc5)
Performance Improvements
Reverts
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]