This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalSelf‑hosted OIDC sign‑in now recovers automatically from already‑redeemed authorization codes; workspace admins can set link expiration for uploaded files (24 h–30 d).
Why it matters: Improves reliability of self‑hosted OIDC authentication by auto‑recovering from stale codes, and enhances security by allowing configurable expiration periods (24 h to 30 d) for shared file links.
Summary
AI summaryUpdates Full changelog, https://github.com/OpnForm/OpnForm/pull/1196, and https://github.com/OpnForm/OpnForm/pull/1203 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Workspace admins can configure expiration for uploaded‑file links (24 h, 3 d, 7 d, 14 d, 30 d). Workspace admins can configure expiration for uploaded‑file links (24 h, 3 d, 7 d, 14 d, 30 d). Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Feature | Medium |
Self‑hosted Enterprise licenses now enable Custom Code, with migration backfilling existing records. Self‑hosted Enterprise licenses now enable Custom Code, with migration backfilling existing records. Source: llm_adapter@2026-07-14 Confidence: low |
— |
| Feature | Low |
Codex worktrees run against isolated seeded local stacks for more dependable concurrent development and E2E testing. Codex worktrees run against isolated seeded local stacks for more dependable concurrent development and E2E testing. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Self‑hosted OIDC sign‑in recovers automatically from already‑redeemed authorization codes. Self‑hosted OIDC sign‑in recovers automatically from already‑redeemed authorization codes. Source: llm_adapter@2026-07-14 Confidence: low |
— |
| Bugfix | Low |
RTL date‑picker navigation arrows now follow the correct direction. RTL date‑picker navigation arrows now follow the correct direction. Source: llm_adapter@2026-07-14 Confidence: high |
— |
Full changelog
What’s improved
This patch makes self-hosted sign-in and Enterprise entitlements more reliable, and gives workspace admins better control over uploaded-file links.
More reliable self-hosted OIDC sign-in
OIDC sign-in now recovers automatically once when an identity provider reports an already-redeemed authorization code. Sign-in initiation and callback throttling are separated, and explicit trusted-proxy support avoids legitimate users being grouped under a proxy IP address. Forced OIDC mode also no longer offers password sign-in as an alternate path.
Configurable uploaded-file link validity
Workspace admins can now choose how long links to uploaded submission files remain available: 24 hours, 3 days, 7 days, 14 days, or 30 days. The setting applies to newly generated links in email notifications, CSV exports, webhooks, Slack, Discord, Telegram, and Google Sheets. The default remains 24 hours and existing links keep their original expiration.
Self-hosted Enterprise Custom Code
Active self-hosted Enterprise licenses now enable Custom Code as expected. The included migration also backfills this entitlement for existing self-hosted license records.
RTL date inputs
Date-picker navigation arrows now follow the correct direction in right-to-left interfaces.
Developer experience
Codex worktrees now run against isolated seeded local stacks, making concurrent development and E2E testing more dependable.
Upgrade note
Run database migrations as part of the upgrade so existing self-hosted license records receive the Custom Code entitlement:
php artisan migrate
If an external reverse proxy sits in front of a self-hosted installation, configure TRUSTED_PROXIES with that proxy’s IP address or CIDR; direct Docker deployments need no additional configuration.
Full changelog
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v2.0.0 Requires running new database migrations before using V2 features.
Beta — feedback welcome: [email protected]