One Time Secret

v0.25.7 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1mo Secrets & Credentials

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

chat email messaging onetime onetimesecret privacy

+1 more

secrets-management

Affected surfaces

auth rbac

ReleasePort's take

Light signal

editorial:auto 1mo

Version v0.25.7 removes org membership Redis indexes and switches to direct lookups.

Why it matters: Deprecates Redis index usage for organization memberships; migrate storage logic before upgrade.

Summary

AI summary

Removed org membership Redis indexes, requiring direct lookups.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds guest domain boundary validation for anonymous share_domain Adds guest domain boundary validation for anonymous share_domain Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Adds permissions API endpoint with frontend composable Adds permissions API endpoint with frontend composable Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Entitlement‑gates org tabs, updates free‑plan billing UI and plan definitions Entitlement‑gates org tabs, updates free‑plan billing UI and plan definitions Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Hides password‑dependent security cards for SSO users and polishes org settings UI Hides password‑dependent security cards for SSO users and polishes org settings UI Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Implements permissions gating, redesigns dashboard and polishes UI Implements permissions gating, redesigns dashboard and polishes UI Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Persists user's sign‑in mode preference with 30‑day expiry Persists user's sign‑in mode preference with 30‑day expiry Source: llm_adapter@2026-06-04 Confidence: high	—
Deprecation	Low	Removes org membership Redis indexes; uses direct lookups instead Removes org membership Redis indexes; uses direct lookups instead Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Fixes email HTML rendering and default favicon issues Fixes email HTML rendering and default favicon issues Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Registers tenant SSO routes when platform env vars are absent Registers tenant SSO routes when platform env vars are absent Source: llm_adapter@2026-06-04 Confidence: high	—
Refactor	Low	Refactors email templates to use shared layout system Refactors email templates to use shared layout system Source: llm_adapter@2026-06-04 Confidence: high	—

Full changelog

What's Changed

Add guest domain boundary validation for anonymous share_domain https://github.com/onetimesecret/onetimesecret/pull/3324
Add permissions API endpoint with frontend composable https://github.com/onetimesecret/onetimesecret/pull/3329
Entitlement-gate org tabs, free-plan billing UI, and plan definition updates https://github.com/onetimesecret/onetimesecret/pull/3330
Hide password-dependent security cards for SSO users + org settings UI polish https://github.com/onetimesecret/onetimesecret/pull/3327
Permissions gating, dashboard redesign, and UI polish https://github.com/onetimesecret/onetimesecret/pull/3332
Persist user's sign-in mode preference with 30-day expiry https://github.com/onetimesecret/onetimesecret/pull/3325
Refactor email templates to use shared layout system https://github.com/onetimesecret/onetimesecret/pull/3316
Remove org membership Redis indexes; use direct lookups https://github.com/onetimesecret/onetimesecret/pull/3319

Fixes

Fixes for email HTML and default favicon https://github.com/onetimesecret/onetimesecret/pull/3321
fix: register tenant SSO routes when platform env vars are absent https://github.com/onetimesecret/onetimesecret/pull/3318

Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.25.6...v0.25.7

Breaking Changes

Removed org membership Redis indexes; direct lookups must be used instead.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track One Time Secret

Get notified when new releases ship.

About One Time Secret

Share sensitive information securely with self-destructing links that are only viewable once.

All releases →

Related context

Related tools

Earlier breaking changes

v0.25.5-coda Removes `site.interface.ui.homepage.trusted_ip_header` config; replaces with `site.network.trusted_proxy.header` settings.
v0.25.5-coda Removes `site.interface.ui.homepage.trusted_proxy_depth` config; replaces with `site.network.trusted_proxy` settings.