Repository navigation
Prepare v2.4.0 release - #357
Merged
Merged
Conversation
Security release: removes the feature-request automation (LLM-written diffs pushed from a write-scoped CI job), redacts secrets in logs, fixes the login rate limit behind proxies, closes the password-setup overwrite, adds audit logging and per-user chat rate limits, keeps AI chat on topic, and runs the container (release and local images) as an unprivileged user with an allowlisted build context. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump to 2.4.0 and the changelog entry for the release.
The release contents are #356 (the 2026-10-03 security review fixes), already on master. See
docs/CHANGELOG.mdfor the notes, including upgrade notes: the config folder changes ownership to uid 1000 on first start (PUID/PGIDsupported), ports below 1024 need a port mapping, andfeaturerequestplus itsgithubToken/githubApp*config are gone.2.4.0 rather than 2.3.8 because a command and its config keys are removed and the container user changes.
After merging: create release
v2.4.0from master. That triggers the Docker build and publish.馃 Generated with Claude Code