HitKeep

v2.12.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 12d Logging

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agent-skills ai analytics angular go mcp

Affected surfaces

auth

Summary

AI summary

Updates 2.12.0, Bug Fixes, and https://github.com/PascaleBeier/hitkeep/issues/225 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Applies standard cross‑origin protection to security layer. Applies standard cross‑origin protection to security layer. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature
Feature	Medium	Adds team OIDC SSO authentication. Adds team OIDC SSO authentication. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Streamlines SSO login and invitation UX. Streamlines SSO login and invitation UX. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Adds annual conversion flow to billing. Adds annual conversion flow to billing. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Routes site settings and invitations in frontend. Routes site settings and invitations in frontend. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Authorizes invite‑aware OIDC provisioning for SSO. Authorizes invite‑aware OIDC provisioning for SSO. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Preserves QR data during site changes in database. Preserves QR data during site changes in database. Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Release blog: HitKeep 2.12.0

2.12.0 (2026-07-14)

Features

auth: add team OIDC SSO (b48f42e)
auth: streamline SSO login and invitation UX (2a5a981), closes #225 #226
billing: add annual conversion flow (#251) (d1c2e3c)
frontend: route site settings and invitations (4c0a0a2), closes #246 #247
sso: authorize invite-aware OIDC provisioning (d5270f6), closes #225 #226

Bug Fixes

database: preserve QR data during site changes (24a5765), closes #248
security: use standard cross-origin protection (3daa095)

Security Fixes

Standard cross‑origin protection implemented in security module

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track HitKeep

Get notified when new releases ship.

About HitKeep

Privacy-first web analytics with goals, funnels, ecommerce tracking, and team management in a single binary with embedded DuckDB (alternative to Google Analytics, Plausible, Umami).

All releases →