One Time Secret

v0.25.8 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 1mo Secrets & Credentials

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

chat email messaging onetime onetimesecret privacy

+1 more

secrets-management

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates Migrations, New commands, and Deployment notes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds `reserialize_fields` housekeeping command to normalize Customer stored fields. Adds `reserialize_fields` housekeeping command to normalize Customer stored fields. Source: llm_adapter@2026-06-07 Confidence: high	—
Feature	Medium	Adds `ensure_member_through_models` command to backfill missing OrganizationMembership through-models. Adds `ensure_member_through_models` command to backfill missing OrganizationMembership through-models. Source: llm_adapter@2026-06-07 Confidence: high	—
Feature	Medium	Adds `domains migrate-sso` command for bulk‑migrating legacy SSO users into a domain organization. Adds `domains migrate-sso` command for bulk‑migrating legacy SSO users into a domain organization. Source: llm_adapter@2026-06-07 Confidence: high	—
Feature	Medium	Adds `domains reconcile-sender` command to reconcile Lettermint sender domain with local mailer config. Adds `domains reconcile-sender` command to reconcile Lettermint sender domain with local mailer config. Source: llm_adapter@2026-06-07 Confidence: high	—
Feature	Low	Implements layered config defaults with deep merge support. Implements layered config defaults with deep merge support. Source: llm_adapter@2026-06-07 Confidence: high	—
Dependency	Low	Updates dependency axios to ^1.16.0. Updates dependency axios to ^1.16.0. Source: llm_adapter@2026-06-07 Confidence: high	—
Dependency	Low	Updates Familia to version 2.10.1. Updates Familia to version 2.10.1. Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	Medium	Fixes theme toggle click issue on auth pages and improves light‑mode watermark contrast. Fixes theme toggle click issue on auth pages and improves light‑mode watermark contrast. Source: llm_adapter@2026-06-07 Confidence: high	—
Refactor	Low	Decouples custom mail sender provider from email transport implementation. Decouples custom mail sender provider from email transport implementation. Source: llm_adapter@2026-06-07 Confidence: high	—
Other	Medium	Migrates unique_index values from JSON to raw format as part of Familia 2.10 boot migration (no manual step required). Migrates unique_index values from JSON to raw format as part of Familia 2.10 boot migration (no manual step required). Source: llm_adapter@2026-06-07 Confidence: low	—

Full changelog

Deployment notes

New commands

reserialize_fields — Normalize Customer stored field format (#3352)
ensure_member_through_models — Backfill missing OrganizationMembership through-models (#3346)
domains migrate-sso — Bulk-migrate legacy SSO users into a domain organization (#3345)
domains reconcile-sender — Reconcile Lettermint sender domain with local mailer config (#3349)

bin/ots housekeeping run Onetime::Customer reserialize_fields                # (#3352)
bin/ots housekeeping run Onetime::Organization ensure_member_through_models  # (#3346)
bin/ots domains migrate-sso --domain example.com       # (#3345)
bin/ots domains reconcile-sender --domain example.com  # (#3349)

Migrations

Unique index JSON→raw — Familia 2.10 automatic boot migration, no manual step required (#3353, #3347)

What's Changed

Add bulk SSO migration command for domain organization https://github.com/onetimesecret/onetimesecret/pull/3345
Add reserialize_fields housekeeping chore for Customer https://github.com/onetimesecret/onetimesecret/pull/3352
Backfill missing OrganizationMembership through-models https://github.com/onetimesecret/onetimesecret/pull/3346
Decouple custom mail sender provider from email transport https://github.com/onetimesecret/onetimesecret/pull/3344
Delete Lettermint sender domain on custom domain removal; add reconcile-sender CLI https://github.com/onetimesecret/onetimesecret/pull/3349
Extend after_login SSO self-heal to repoint default_org and archive personal workspace https://github.com/onetimesecret/onetimesecret/pull/3337
Fix theme toggle click on auth pages; improve light-mode watermark contrast https://github.com/onetimesecret/onetimesecret/pull/3356
Implement layered config defaults with deep merge support https://github.com/onetimesecret/onetimesecret/pull/3342
Migrate unique_index values from JSON to raw format (Familia 2.10) https://github.com/onetimesecret/onetimesecret/pull/3353
Simplified brand/image endpoint implementations; also renames concern to policy https://github.com/onetimesecret/onetimesecret/pull/3341

Dependencies

Update dependency axios to ^1.16.0 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3333
Update Familia to v2.10.1 #3353

Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.25.7...v0.25.8

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track One Time Secret

Get notified when new releases ship.

About One Time Secret

Share sensitive information securely with self-destructing links that are only viewable once.

All releases →

Related context

Related tools

Earlier breaking changes

v0.25.5-coda Removes `site.interface.ui.homepage.trusted_ip_header` config; replaces with `site.network.trusted_proxy.header` settings.
v0.25.5-coda Removes `site.interface.ui.homepage.trusted_proxy_depth` config; replaces with `site.network.trusted_proxy` settings.