Backend 0.96.1 fixes three access-control and abuse-prevention issues. Nuphos Cloud has run with these fixes since October 17, so there is nothing to do if you use Nuphos Cloud.
Security
Self-hosted backends on v0.96.0 or earlier are affected. Upgrade to v0.96.1.
- Plan access: a team member could read, approve, update or retry an approval plan from a conversation they could not open. Plans now follow their conversation's access, in the app and in Slack approvals.
- Chat request validation: the chat endpoint accepted malformed
idvalues. Non-string values are now rejected. - Sign-in code limits: email sign-in codes had no daily cap per address or per IP. Requests are now limited.
Upgrading
Pull ghcr.io/nuphos/backend:v0.96.1 and restart. Docker Compose builds from source: check out backend-v0.96.1 and rebuild. The Zeabur and Railway templates point at v0.96.1. No configuration change is needed. The new sign-in limits use Redis when it is configured; without Redis, only the existing cooldown and lockout apply.