Zero-TOTP

Full Changelog: https://github.com/SeaweedbrainCY/zero-totp/compare/v2.0.0...v2.0.0

[!important]
This version brings security patch. Upgrade is highly recommended.

🐳 New Docker images

Update available upon the following tags : 2.0, 2.0.0 and latest.
Recommended tag :

• API : ghcr.io/seaweedbraincy/zero-totp-api:2.0
• Frontend : ghcr.io/seaweedbraincy/zero-totp-frontend:2.0

Exact tag :

• API : ghcr.io/seaweedbraincy/zero-totp-api:2.0.0
• Frontend : ghcr.io/seaweedbraincy/zero-totp-frontend:2.0.0

Latest tag:

• API : ghcr.io/seaweedbraincy/zero-totp-api:latest
• Frontend : ghcr.io/seaweedbraincy/zero-totp-frontend:latest

Breaking change

• The account deletion endpoint was switched from DELETE to POST. Frontend/API Client version should adapt accordingly. No action beside update required.

Features

• Add the support of capacitor for iOS application building. The iOS application is not yet disclosed to the public but this version brings most of the iOS work.
• Add a loading screen to improve navigation
• Bring a whole new design for mobiles
• Add a new capacitor plugin to safely handle secret storing in vault (with biometrics protection)
• CSP hardening.
• Add support of bearer authentication that can be used instead of cookie

Fix

• Fixed src_ip propagation for rate-limiting, fixed a bug injecting the wrong object instead of tokens, and made request bodies nullable where appropriate (e.g. /auth/refresh no longer requires a body for web clients).
• Introduced a proper context-passing mechanism through Connexion so controllers consistently receive src_ip, user_obj, and token_info as kwargs instead of ad-hoc parameter names (ip, user_id, etc.), fixing several inconsistent/incorrect argument injections.
• Hardened CICD dependencies

Chore

• Bump fast-uri from 3.1.0 to 3.1.2 in /frontend
• Bump ip-address and express-rate-limit in /frontend
• bump cryptography from 46.0.6 to 46.0.7 in /api
• Bumps python-multipart from 0.0.27 to 0.0.31.
• Bump starlette from 0.49.1 to 1.3.1 in /api
• Bump hono from 4.12.21 to 4.12.27 in /frontend
• Bump tmp from 0.2.5 to 0.2.7 in /frontend
• Bump tmp from 0.2.5 to 0.2.7 in /mobile
• Bump idna from 3.10 to 3.15 in /api
• Bump follow-redirects from 1.15.11 to 1.16.0 in /frontend
• Bump python-dotenv from 1.1.0 to 1.2.2 in /api
• Bump aiohttp from 3.13.4 to 3.14.1 in /api