Oikos

v1.2.0 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 18d Productivity & Wikis

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

docker family family-planner home-automation planner-app privacy-first

+4 more

progressive-web-app pwa self-hosted selfhosted-apps

Affected surfaces

auth rbac

Summary

AI summary

API Tokens now support optional per-module permission scopes enforced across REST API and MCP endpoints.

Full changelog

API Tokens: optional per-module permission scopes. An admin can restrict a token to individual modules and access levels (<module>:read / <module>:write, where write implies read) instead of granting the creator's full access. This matters most for tokens handed to an off-device AI/MCP client — for example a token that may write the calendar but can never read the health module. Tokens created without scopes keep full role-based access, so existing tokens are unaffected.

API Tokens: scoped tokens are enforced across both the REST API and the MCP endpoint. A scoped token can only reach modules on its allow-list — every other /api/v1 path is denied, tools/list hides MCP tools the token cannot use, out-of-scope tools/call is refused, and the OpenAPI bridge inherits the same limits because it loops back through the REST layer with the same token.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Oikos

Get notified when new releases ship.

About Oikos

Family planner for small households

v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
v0.66.0 Project renamed from Oikos to Yuvomi.
v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.