15 releases 15 tags

RSS feed

• v0.8.0 494c2052fc

  Compare

  v0.8.0 — Phase 8: Dependency security & user management Stable

  vmanne-poc released this 2026-10-14 23:56:29 -04:00 | 55 commits to main since this release

  Recommended upgrade: clears all known vulnerabilities in production dependencies and fixes missing unsubscribe links (#21).

  Merged via PR #22.

  Security

  • NestJS 10 → 11.2 (Express 5), @nestjs/config 4, @nestjs/schedule 6, @nestjs/jwt / @nestjs/passport 11, nodemailer 6 → 10, Jest 30. npm audit --omit=dev: 12 vulnerabilities (4 high) → 0 (#14).
  • Password change ends all other sessions; deleted users' tokens are rejected.

  Added

  • Account page: change password.
  • Users page (administrator): create accounts.
  • Members page: owner/member roles, add by email, change role, remove, leave (#15). Projects always keep one owner.

  Fixed

  • Emails without a template had no unsubscribe link (#21). Every email now has a footer link plus List-Unsubscribe / one-click List-Unsubscribe-Post headers.
  • Unsubscribes were counted as clicks.
  • Opening the unsubscribe link (GET) unsubscribed immediately, so link scanners could unsubscribe people. GET now shows a confirmation; POST unsubscribes.
  • Any member could delete a project; now owners only.
  • Emails stored lowercase; sign-in case-insensitive.

  Behavior changes

  • Integrations must POST /track/unsubscribe/:id to unsubscribe.
  • Documentation other than README, CHANGELOG, CONTRIBUTING, and LICENSE moved out of the code repository. The user guide is on the wiki.

  Upgrading

  • Rebuild: docker compose up -d --build. The schema change (User.tokenVersion) applies automatically; existing sessions stay valid.

  Tests: 45 unit + 29 end-to-end passing.

  Milestone: Phase 8 · Not included: password reset and account disable (#23).

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads