This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Moderate signalOIDC connections can now be updated without replacing client secrets, and PostgreSQL health checks use the configured database name to prevent misleading errors.
Why it matters: Updates allow OIDC secret rotation without full reconfiguration; PostgreSQL health‑check fixes eliminate false‑positive alerts in deployments using custom DB names.
Summary
AI summaryOIDC connections can be updated without replacing client secrets, PDF image handling improved, and PostgreSQL health checks now use the configured database name.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
OIDC connections can be updated without replacing client secret. OIDC connections can be updated without replacing client secret. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
OIDC callback automatically restarts once if stale, with recovery path. OIDC callback automatically restarts once if stale, with recovery path. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
PDF templates handle remote and local images more reliably with safer fetching. PDF templates handle remote and local images more reliably with safer fetching. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Medium |
Docker workflow now builds API and client images for linux/amd64 and linux/arm64 with 2.2.0 and latest tags. Docker workflow now builds API and client images for linux/amd64 and linux/arm64 with 2.2.0 and latest tags. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Deprecation | Low |
Removed obsolete yearly‑upgrade offer. Removed obsolete yearly‑upgrade offer. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
PostgreSQL health checks now use configured database name to avoid misleading errors. PostgreSQL health checks now use configured database name to avoid misleading errors. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Corrected plan messaging for custom SMTP on OpnForm Cloud. Corrected plan messaging for custom SMTP on OpnForm Cloud. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Low |
Updated Korean backend translations. Updated Korean backend translations. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
What’s improved
This release makes self-hosted OpnForm more dependable, especially around SSO configuration, Docker deployments, and PDF generation.
More reliable OIDC sign-in
You can now update an existing OIDC connection without replacing its client secret. If your public URL changes, refresh the callback with Use current app URL and save the connection instead of recreating it. A stale OIDC callback is also restarted automatically once, with a clear recovery path if it cannot complete.
Better PDF image handling
PDF templates can use supported remote and locally stored images more reliably, with safer remote image fetching.
Healthier self-hosted database checks
PostgreSQL health checks now use the configured database name, preventing misleading connection errors on installations with custom database settings.
Other improvements
- Correct plan messaging for custom SMTP on OpnForm Cloud.
- Updated Korean backend translations.
- Removed an obsolete yearly-upgrade offer.
Docker images
The v2.2.0 tag has been pushed to main. The Docker workflow is now building the API and client images for linux/amd64 and linux/arm64, with both the 2.2.0 and latest tags.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v2.0.0 Requires running new database migrations before using V2 features.
Beta — feedback welcome: [email protected]