Shelf

Security release

This release contains a security fix for GHSA-w7hm-pwcf-64rc — a broken access control (IDOR) issue in several booking endpoints that let low-privilege workspace members (Self Service / Base) read, export, and post notes to other members' bookings within their workspace. Severity: High (CVSS 7.1).

Affected versions: all versions prior to 2.0.1.

All self-hosted operators should upgrade immediately.

🚀 Features

• feat(feedback): readable screenshots, auto-captured context, and error-page reporting by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2690
• feat(assets): collapse duplicate booking bars in availability view by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2691
• feat(assets): filter, search and paginate the asset activity log by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2658
• feat: bring book-by-model (asset models) to the Companion app by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2702
• feat(companion): quantity-tracked check-in disposition + partial check-out by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2706
• feat(bookings): subscribable iCal calendar feed by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2602
• feat(sso): support Shibboleth with robust SSO group-to-role matching by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2708
• feat(bookings): archive past-due reserved bookings (manual + auto) by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2623
• feat(companion): book-by-model fulfil-and-check-out scanner (scan to assign + check out) by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2710
• feat(assets): add import-ready CSV export for cross-workspace re-import by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2714

🐛 Fixes

• fix(bookings): correct multi-slice QT checkout (render, attribution, notes) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2698
• fix(availability): keep thumbnails fixed-size and truncate long names by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2699
• fix(booking): default a bare quantity-tracked scan to all remaining units on partial check-in/out by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2703
• fix(bookings): eliminate partial-checkout transaction timeout on large bookings by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2704
• fix(assets): repair custody sort in advanced index by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2705
• fix(companion): book-by-model checkout is no longer a dead-end by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2707
• fix(assets): stop currval() Postgres error flood on New Asset page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2711
• fix(assets): repair kit assignment on asset import (pivot + kit-custody inheritance) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2712
• fix(bookings): stop role demotion from hiding users' own bookings + close four self-service booking IDORs by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2715

⚡ Performance

• perf(assets): paginate the advanced index before projecting by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2692
• perf(bookings,assets): paginate-first quick wins from the #2692 playbook by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2693

🧹 Chores

• chore: delete docs/proposals directory by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2709

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@2.0.1