Alessandro (Ale) Segala
36b985585d
Merge branch 'main' into actors/francis-addr
2026-09-20 10:14:39 -07:00
pocket-id-bot[bot]
bb05e69224
release: 2.16.0
2026-09-20 14:44:38 +00:00
Elias Schneider
ba246e6146
ci/cd: replace local release script with action
2026-09-20 16:39:40 +02:00
Elias Schneider
3249b0dc8c
feat: update the design of the email templates
2026-09-20 16:07:29 +02:00
Elias Schneider
8fe53ed42c
ci/cd: include SBOMs for binaries
2026-09-20 15:13:11 +02:00
Elias Schneider
5a1c6f0547
ci/cd: include frontend dependencies in SBOM
2026-09-20 15:06:58 +02:00
Elias Schneider
4858db3bb4
fix: login with Yubikey not working in some Safari browsers
2026-09-20 14:02:08 +02:00
Alessandro (Ale) Segala
79a0fca12b
chore: update francis to rc7 ( #1769 )
2026-09-20 12:23:20 +02:00
ItalyPaleAle
f5a7d0c683
Actually use rc.8
2026-09-20 00:53:28 -07:00
ItalyPaleAle
52cd97587a
chore: update francis to rc7
2026-09-20 00:43:18 -07:00
ItalyPaleAle
277d40c510
More test fixes
2026-09-20 00:28:17 -07:00
ItalyPaleAle
bf1f72e6e1
Fix tests
2026-09-20 00:15:13 -07:00
ItalyPaleAle
fadb1a5552
feat: add FRANCIS_HOST to connect to a standalone Francis runtime
...
FRANCIS_HOST decides where the Francis actor runtime lives. When set to "embedded" (the default), Pocket ID starts the runtime inside its own process.
Any other value is the address, or a comma-separated list of addresses, of a standalone Francis runtime. Pocket ID then connects to it as a remote actor host and starts no embedded runtime.
Because when using a remote runtime, it's likewise not possible to enforce a single instance of Pocket ID is running at once, the env vars currently have the `EXPERIMENTAL_` prefix, are **undocumented**, and show a warning if used.
Notes:
- Connecting to a standalone runtime also needs FRANCIS_HOST_PSK or FRANCIS_HOST_JWT_FILE, and optionally (but recommended) FRANCIS_CA.
- When connecting to a remote runtime, exporting Pocket ID data does not include the actor state, which will need to be backed up and restored separately
2026-09-19 23:38:18 -07:00
Elias Schneider
4ba28992ff
fix: loading indicator not visible
2026-09-20 01:32:19 +02:00
Elias Schneider
98f9e39785
ci/cd: upgrade git cliff version
2026-09-19 21:17:11 +02:00
Elias Schneider
a38fe0a789
release: 2.15.0
2026-09-19 20:30:39 +02:00
Elias Schneider
6060c6e12e
chore(deps): update backend dependencies
2026-09-19 20:25:04 +02:00
Elias Schneider
0eb531333a
Revert "chore: upgrade alpine packages on image build"
...
This reverts commit d2c2cdaa5d
2026-09-19 19:44:50 +02:00
Elias Schneider
4edfaf622a
fix: default profile picture empty if username contains only one char
2026-09-19 19:43:38 +02:00
Elias Schneider
cad8b68abc
docs: update PR template
2026-09-19 19:35:49 +02:00
Elias Schneider
d9e9df9960
docs: update AI Usage Policy
2026-09-19 19:35:49 +02:00
Elias Schneider
16476efd28
chore(translations): update translations via Crowdin ( #1764 )
2026-09-19 19:00:16 +02:00
dependabot[bot]
2eb6c3dcdb
chore(deps): Bump go.opentelemetry.io/otel/exporters/zipkin from 1.44.0 to 1.45.0 in /backend ( #1765 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-19 18:53:24 +02:00
Elias Schneider
b8163605ac
fix: preserve AAGUID icon hashes on Windows
2026-09-19 18:52:47 +02:00
Mike Beaumont
b5a07a29ef
feat: include passkey icons based on AAGUID ( #1756 )
2026-09-19 09:41:53 -07:00
Elias Schneider
c22003f6de
refactor: fix type checks
2026-09-19 17:24:30 +02:00
Elias Schneider
63050add4e
feat(ux): replace individual save buttons with single "unsaved changes bar" ( #1757 )
2026-09-19 15:23:06 +00:00
dependabot[bot]
818333fb38
chore(deps): Bump the "all-dependencies" group with 2 updates across multiple ecosystems ( #1760 )
2026-09-18 15:17:43 +00:00
Dario Ackermann
b76a8171bf
fix(i18n): German translations for client secrets ( #1759 )
2026-09-18 14:45:32 +00:00
Elias Schneider
2084dffd8d
fix: prevent PAR requirement bypass via conflicting request parameters
2026-09-17 21:37:41 +02:00
Elias Schneider
43c0b797fd
fix: don't auto submit OAuth device codes
2026-09-17 21:08:52 +02:00
Elias Schneider
b1463297f4
chore(translations): update translations via Crowdin ( #1754 )
2026-09-17 20:33:55 +02:00
Elias Schneider
81cb290bed
fix: show more user friendly error page for authorize interaction failures
2026-09-15 16:59:35 +02:00
Elias Schneider
d2c2cdaa5d
chore: upgrade alpine packages on image build
2026-09-15 15:47:45 +02:00
Elias Schneider
1ee34fddea
chore(deps): update vulnerable packages
2026-09-15 15:30:18 +02:00
Elias Schneider
5cbacd81e6
fix: limit JPG and PNG pixels to prevent decompression bomb
2026-09-15 14:51:06 +02:00
Elias Schneider
fd99a6b742
fix: add missing await to catch redirect invalid URL errors
2026-09-14 21:11:54 +02:00
4dc3b68b46
chore(deps): Bump the "all-dependencies" group with 2 updates across multiple ecosystems ( #1742 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com >
2026-09-14 14:19:12 +00:00
github-actions[bot] and stonith404
9bbd34acc7
chore: update AAGUIDs ( #1751 )
...
Co-authored-by: stonith404 <58886915+stonith404@users.noreply.github.com >
2026-09-14 09:37:31 +00:00
Alessandro (Ale) Segala
de2780bbef
fix: serve bundled logo if no custom logo is set ( #1748 )
2026-09-14 11:33:31 +02:00
dependabot[bot]
41eb35b8a7
chore(deps): Bump adm-zip from 0.6.0 to 0.6.1 ( #1747 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-13 11:35:48 -05:00
Alessandro (Ale) Segala
1da2934766
chore: update Francis to rc.6 ( #1745 )
2026-09-12 15:01:11 -05:00
Alessandro (Ale) Segala
7ddc5d690b
fix: trim values loaded from _FILE env vars in AppConfig ( #1741 )
2026-09-07 19:10:54 -05:00
c65b77c980
chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems ( #1739 )
...
Co-authored-by: Kyle Mendell <kyle@pocket-id.org >
Co-authored-by: Kyle Mendell <kmendell@ofkm.us >
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-07 09:24:16 -05:00
Elias Schneider
f91fb76eba
chore(translations): update translations via Crowdin ( #1724 )
2026-09-07 08:47:44 -05:00
Alessandro (Ale) Segala
33090fa3e1
feat: use HS256 for Pocket ID's own session tokens + fixes ( #1733 )
2026-09-07 15:27:08 +02:00
Alessandro (Ale) Segala
8c76ba0714
chore: update Francis to rc.5 ( #1738 )
2026-09-03 07:22:49 -05:00
dependabot[bot]
deefdd88d9
chore(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /backend ( #1736 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-02 11:30:44 -05:00
Alessandro (Ale) Segala
01cc44246a
chore: upgrade jwx to v4 ( #1730 )
2026-08-31 14:12:35 -07:00
Alessandro (Ale) Segala
fa8aa44706
chore: update Francis to rc.2 ( #1728 )
2026-08-31 05:15:48 -07:00
Alessandro (Ale) Segala