Security
This release tightens several authorization checks. Nuphos Cloud has run with these fixes since 2026-10-23. Self-hosted backends on v0.101.9 or earlier are affected; upgrade to v0.101.10 or later (we recommend the latest release).
- Integration connection flows: completing a workspace connection now re-checks that the user is still a team administrator, and an error callback can no longer cancel another user's pending connection.
- Permission-grant proposals: a proposal is readable only by its proposer and team administrators, matching the list view.
- Quotas and admin-only actions: re-enabling a trigger or watch group now counts toward the quota, opening a Cloudflare D1 database as a connection requires the administrator role, and the Lark chat picker requires sign-in.
No configuration change is needed.
Upgrading from v0.101.8 or v0.101.9
If you are on v0.101.8, also read the v0.101.9 notes; they need no extra action.
- No database changes and no environment variable changes. A backup is still recommended before any upgrade.
- Update the image and restart:
- Compose: check out
backend-v0.101.10, rebuild the backend, and rundocker compose up -d backend. - Railway: set the backend service image to
ghcr.io/nuphos/backend:v0.101.10. - Zeabur: set the backend image to
v0.101.10. - Helm: set
backend.image.tag: v0.101.10; the chart in the repository still defaults toappVersion0.101.8.
- Compose: check out
- Check that
/healthreturns 200.
Read the full backend v0.101.10 release notes.