Patch release with security fixes from an audit of the worker, web app and deploy path. Updating is recommended for every deployment.
Fixes
- Invites need their token. An open invite could be claimed through plain email sign-up by anyone who knew the invited address. Invites are now redeemed only with the invite link, or by an OAuth sign-in whose provider has verified the email.
- OAuth sign-in links accounts only on a provider-verified email.
- API tokens follow their creator's access. A member could create an all-projects token that read any project, and removed or demoted users kept reading through older tokens. Creating tokens is now owner/admin only, and every read re-checks access.
- Removing a user works and revokes what they left behind — their API tokens and pending invites. Before, the removal could fail outright.
- MCP re-checks access on every call. Revoking a token, removing or demoting a user, or turning off MCP writes now takes effect on open sessions. Project access is enforced on every tool, including
emit_event. - OAuth client registration is off while MCP is off, and is size-limited and rate-limited. The consent screen only accepts same-origin submissions.
- Revoking a device token disconnects its open WebSocket, and deleting a project disconnects all of its devices.
- Open dashboards stop streaming to users whose access or session was revoked.
- Chart labels are escaped before rendering.
- The post-login redirect only follows same-origin links.
- The instance signing secret can't be regenerated by a failed read, which would have orphaned stored integration and sign-in secrets.
- Webhook templates JSON-escape device values, and device payloads can't override server-set fields.
- Sturdier under load and abuse:
- the sign-in rate limit keeps working if KV fails;
- one slow automation no longer delays or skips other projects' schedules;
- automations, event payloads and per-project variables are size-capped;
- public dashboards can't bypass the edge cache.
- Worker fetches to your own zone always pass through Cloudflare.
- Deploys install exact dependency versions from the committed lockfile when the build's bun can read it, and fall back to a normal install on older bun.
Behaviour changes
- Only owners and admins can create API tokens.
- MCP clients must use PKCE (OAuth 2.1), and sessions expire after 24 hours; clients reconnect automatically.
Updating
Open your Worker in the Cloudflare dashboard and Retry build, or use Settings → Version & updates inside nodrix.