Release date: 2026-04-17

| Area | Key Changes |
|------|-------------|
| OIDC hardening | ID token signing alg resolution with discovery fallback + explicit override (OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG), token endpoint auth method override (OIDC_TOKEN_ENDPOINT_AUTH_METHOD), HS-alg mismatch auto-retry in callback, Keycloak/Authentik preflight warnings, oidc-doctor.cjs diagnostic tool, provider-specific .env example files |
| Admin OIDC controls | Runtime JIT provisioning toggle via admin panel + DB (oidcJitProvisioningEnabled column + migration), OIDC-only invited user creation (oidcOnly flag), block self-registration toggle in oidc_enforced mode |
| HTTPS redirect policy | Refactored into pure httpsRedirectPolicy.ts module, new ENFORCE_HTTPS_REDIRECT env var, mixed http/https FRONTEND_URL support, IPv4 loopback healthchecks |
| Frontend resilience | AuthStatusErrorPanel with retry for backend connectivity failures, registrationEnabled propagation to hide register link/route, multi-image drag-and-drop import in Editor, Excalidraw asset copy script for dev + build |

Upgrading

Data safety checklist

• Back up backend volume (dev.db, secrets) before upgrading.
• Let migrations run on startup (RUN_MIGRATIONS=true) for normal deploys.
• Run docker compose -f docker-compose.prod.yml logs backend --tail=200 after rollout and verify startup/migration status.

Recommended upgrade (Docker Hub compose)

docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -d

Pin images to this release (recommended for reproducible deploys)

Edit docker-compose.prod.yml and pin the release tags:

services:
  backend:
    image: zimengxiong/excalidash-backend:v0.5.0
  frontend:
    image: zimengxiong/excalidash-frontend:v0.5.0

Example:

docker compose -f docker-compose.prod.yml up -d

CSRF Protection (8a78b2b)

• Implemented comprehensive CSRF (Cross-Site Request Forgery) protection for enhanced security
• Added new backend/src/security.ts module for security utilities
• Frontend API layer now handles CSRF tokens automatically
• Added integration tests for CSRF validation

Upload Progress Indicator (8f9b9b4)

• Added a visual upload progress bar when users upload files
• New UploadContext for managing upload state across components
• New UploadStatus component displaying real-time upload progress
• Save status indicator when navigating back from the editor
• Improved error handling and recovery for failed uploads

Bug Fixes

• Fixed broken e2e tests (cae8f3c)
• Replaced deprecated substr() with substring()
• Fixed stale state issues in error handling
• Fixed missing useEffect dependencies
• Fixed CSS class conflicts in progress bar styling
• Added error recovery for save state in Editor

Infrastructure

• Updated docker-compose configurations with new environment variables
• E2E test suite improvements and reliability fixes
• Added Kubernetes deployment note in README

Kubernetes

A CSRF_SECRET environment variable is now required for CSRF protection. Generate a secure 32+ character random string:

openssl rand -base64 32

Add it to your deployment:
- Docker Compose: Add CSRF_SECRET=<your-secret> to the backend service environment
- Kubernetes: Add to your ConfigMap/Secret and reference in the backend deployment

If not set, the backend will refuse to start.