shellhub releases

What's Changed

• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 in /tests by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6146
• feat(ui-react): implement announcements admin panel by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6133
• feat(ui-react): add admin sessions list and detail pages by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6107
• ci: remove private registry dependency from CI workflows by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6150
• fix(infra): ensure postgres container restarts after host reboot by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6152
• refactor(ui-react): unify main and admin sidebar behavior by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6151
• chore(deps): bump axios from 1.13.6 to 1.15.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6157
• ui: bump axios from 1.14.0 to 1.15.0 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6156
• fix(cli): ensure first user created via CLI is admin by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6155
• fix(gateway): raise WebSocket timeouts and enable TCP keepalive by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6158
• chore(ci): remove verify-fix workflow by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6161
• feat(agent): default transport to yamux (v2) by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6163
• fix(ui-react): fix sidebar behavior when terminal is open by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6166
• refactor(ui-react): add reusable DataTable component by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6164
• refactor(api): remove RSA signature gate from initial setup flow by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6162
• fix(ui-react): fix License page upload input on Chromium by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6189
• docker: api: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6186
• docker: cli: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /cli by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6185
• docker: agent: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /agent by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6184
• docker: ssh: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6183
• docker: gateway: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /gateway by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6182
• docker: ui: bump nginx from 1.29.7-alpine to 1.29.8-alpine in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6181
• ui: bump typescript-eslint from 8.58.0 to 8.58.2 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6180
• refactor(ui-react): split useCopy hook into its own file by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6167
• chore: update gliderlabs/ssh fork to fix golang.org/x/crypto v0.50.0 compatibility by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6193
• ui: bump eslint-plugin-jest from 29.15.1 to 29.15.2 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6171
• ssh: bump golang.org/x/net from 0.52.0 to 0.53.0 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6170
• api: bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6177
• api: bump golang.org/x/crypto from 0.49.0 to 0.50.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6178
• ui: bump follow-redirects from 1.15.11 to 1.16.0 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6192
• agent: bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 in /agent by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6172
• api: bump github.com/testcontainers/testcontainers-go/modules/postgres from 0.41.0 to 0.42.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6179
• api: bump github.com/getsentry/sentry-go from 0.44.1 to 0.45.1 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6175
• chore(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6188
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6187
• fix(ui-react): clear query cache on logout to drop stale user data by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6194
• fix(ui-react): surface swallowed errors in ConfirmDialog delete flows by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6168
• chore(deps): migrate dependabot from ui to ui-react by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6198
• feat(cli): add type column to namespace list output by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6197
• docker: ui-react: bump node from 24.13.0-alpine3.22 to 24.15.0-alpine3.22 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6207
• ui-react: bump @types/node from 25.5.0 to 25.6.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6209
• ui-react: bump @hey-api/openapi-ts from 0.94.3 to 0.94.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6210
• ui-react: bump typescript-eslint from 8.57.0 to 8.58.2 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6211
• ui-react: bump vitest from 4.1.0 to 4.1.4 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6208
• ssh: bump github.com/pires/go-proxyproto from 0.11.0 to 0.12.0 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6206
• ui-react: bump @tiptap/markdown from 3.22.2 to 3.22.3 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6205
• api: bump github.com/testcontainers/testcontainers-go/modules/mongodb from 0.41.0 to 0.42.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6204
• docker: ssh: bump alpine from 3.23.3 to 3.23.4 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6203
• docker: gateway: bump alpine from 3.23.3 to 3.23.4 in /gateway by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6200
• docker: api: bump alpine from 3.23.3 to 3.23.4 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6202
• docker: ui-react: bump nginx from 1.29.4-alpine to 1.29.8-alpine in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6201
• docker: cli: bump alpine from 3.23.3 to 3.23.4 in /cli by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6199
• chore(ui-react): remove deprecated baseUrl from ui-react's tsconfig.json by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6212
• refactor(ui-react): use @ import alias by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6213
• fix(openapi): align tag name pattern with backend validation by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6216
• ui-react: bump postcss from 8.5.8 to 8.5.10 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6225
• ui-react: bump axios from 1.15.0 to 1.15.1 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6224
• ui-react: bump @tiptap/react from 3.22.2 to 3.22.4 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6221
• ui-react: bump autoprefixer from 10.4.27 to 10.5.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6223
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6220
• api: bump github.com/labstack/gommon from 0.4.2 to 0.5.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6219
• api: bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6217
• fix(api): expose internal namespace lookup for SSH service by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6228
• fix(api): let admin panel through RequiresTenant guard by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6229
• feat(ui-react): add Containers page and components by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6214
• feat(ui-react): add team invitations feature by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6191
• ui-react: bump typescript-eslint from 8.58.2 to 8.59.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6222
• fix(ui-react): fix lint error in ContainerTagsPopover test by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6231
• api: bump github.com/moby/moby/api from 1.54.1 to 1.54.2 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6218
• docs(api): remove status field from namespace member schema by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6230
• feat(ui): add SAML SSO login and admin authentication settings by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6196
• test: optimize healthchecks and force image rebuild by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6234
• fix(ui-react): make sidebar pinned by default on larger screens by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6235
• agent: bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /agent by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6238
• chore(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6237
• chore(deps): bump postcss from 8.4.49 to 8.5.10 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6239
• fix(ui-react): fix sidebar height and content overflow in layouts by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6233
• ui-react: bump vitest from 4.1.4 to 4.1.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6247
• ui-react: bump @tiptap/extension-link from 3.22.2 to 3.22.4 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6245
• ui-react: bump @tanstack/react-query-devtools from 5.91.3 to 5.100.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6246
• ui-react: bump react-router-dom from 7.13.1 to 7.14.2 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6243
• fix(ci): update claude-code-action to v1 by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6252
• feat(ui-react): wire firewall-rules and web-endpoints into the console by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6253
• fix(ui): restore sidebar pin and hover behavior by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6251
• ui-react: bump @tiptap/markdown from 3.22.3 to 3.22.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6244
• api: bump github.com/getsentry/sentry-go from 0.45.1 to 0.46.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6242
• refactor(cli): replace bind() with explicit field assignment by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6254
• ui-react: bump postcss from 8.5.10 to 8.5.12 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6257
• ui-react: bump globals from 17.4.0 to 17.5.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6260
• ui-react: bump eslint from 10.0.3 to 10.2.1 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6259
• ui-react: bump zustand from 5.0.11 to 5.0.12 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6258
• api: bump github.com/getsentry/sentry-go from 0.46.0 to 0.46.1 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6256
• ui-react: bump @tanstack/react-query-devtools from 5.100.5 to 5.100.6 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6255
• chore: bump shellhub version to v0.24.2 by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6261
• fix(ci): generate release notes from docker-publish draft by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6263

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.24.1...v0.24.2

Security

Fixes four cross-tenant and input-validation advisories:

• GHSA-vwx9-7qcf-gg7f — cross-tenant IDOR on namespace endpoints reachable via API Key and JWT callers, allowing a caller to read, edit, delete or toggle session recording of a namespace they are not scoped to, and to enumerate namespaces across tenants on the list endpoint. (initially fixed in v0.21.6)
• GHSA-j72x-xfwg-783f — GET /api/devices/:uid returned the full device object for any authenticated caller, allowing cross-tenant disclosure of device metadata (hostname, MAC, OS, public key, remote address, last-seen).
• GHSA-9w9c-9w8m-w89q — GET /api/sessions/:uid returned the full session object for any authenticated caller, allowing cross-tenant disclosure of SSH session data (username, device UID, remote IP, authentication state, timestamps).
• GHSA-47r2-v3x6-wff9 — filter and sort query parameters on the device list accepted attacker-controlled identifiers as BSON keys, enabling HTTP 500 crash-DoS and blind regex extraction via $regex values.

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.21.6...v0.21.7

Security

Fixes GHSA-vwx9-7qcf-gg7f — cross-tenant IDOR on namespace endpoints reachable via API Key and JWT callers, allowing a caller to read, edit, delete or toggle session recording of a namespace they are not scoped to, and to enumerate namespaces across tenants on the list endpoint. Reported by @Edu0x01.

What's Changed

• fix(api): prevent cross-tenant access via API Key and JWT by @gustavosbarreto

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.21.5...v0.21.6

What's Changed

• feat(ui-react): add admin user management pages by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6086
• feat(ui): add admin namespace management by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6105
• feat(ui-react): handle token query param on Login page for admin login-as-user by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6110
• fix(ui-react): fix connection announcement overflow in admin namespace details by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6109
• feat(ui-react): add admin device list and detail pages by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6113
• ui: bump defu from 6.1.4 to 6.1.6 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6115
• ui: bump lodash from 4.17.23 to 4.18.1 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6111
• fix(ci): temporarily pin claude-code-action to 1.0.88 by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6125
• feat(ui-react): add admin firewall rules list and detail pages by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6116
• ci: add SBOM generation to release workflows by @otavio in https://github.com/shellhub-io/shellhub/pull/6112
• fix(ui-react): resolve prettier and eslint formatting conflicts by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6126
• ui: bump turndown from 7.2.2 to 7.2.4 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6122
• ui: bump vuetify from 3.12.3 to 3.12.5 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6121
• ui: bump sass from 1.98.0 to 1.99.0 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6120
• api: bump github.com/lib/pq from 1.12.1 to 1.12.3 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6119
• ui: bump @vue/runtime-dom from 3.5.31 to 3.5.32 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6118
• chore(deps-dev): bump vite from 7.3.1 to 7.3.2 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6117
• ui: bump qrcode.vue from 3.8.0 to 3.8.1 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6123
• fix(api): add id tiebreaker to paginated queries by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6127
• fix(ui-react): use server-side filtering for device search by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6129
• fix(ui-react): use plain strings for public key filter tags by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6128
• fix(api): qualify column names in device queries with JOINs by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6130
• fix(api): place AND operator before connector filter in device list by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6131
• fix(api): compute device online status in session queries by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6137
• fix(store): add missing "lt" operator to PG filter parser by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6140
• feat(cli): add namespace enumeration capabilites by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6132
• chore: bump shellhub version to v0.24.1 by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6141

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.24.0...v0.24.1