Skip to main content

v0.13.1 — install / deploy L1 repair + security patch

A patch release: no new features, no schema changes. It fixes fresh role-separated (L1) installs and deployments that could fail to come up, and picks up a security bump. The full machine-readable changelog lives in CHANGELOG.md.

Highlights​

Fresh L1 (role-separated) installs and deployments now boot​

Several confirmed bugs prevented a from-scratch role-separated stack — the posture install.sh provisions — from coming up. They only affected L1 stacks (operators who set POSTGRES_APP_PASSWORD); legacy single-role deployments were unaffected, which is why they went unnoticed until the release gate booted the production compose file from scratch.

  • trustedoss_app role was never created. scripts/postgres-init.sh interpolated the role name / password inside a dollar-quoted DO $$ … $$ block, where psql performs no variable substitution — the literal :'app_user' reached the server and aborted the init script, so every L1 backend then failed password auth as trustedoss_app. Role creation now uses SELECT format(…) … \gexec with WHERE NOT EXISTS (SQL-quoted, idempotent).
  • AUTO_MIGRATE never reached the container. install.sh writes AUTO_MIGRATE=false on L1 stacks (migrations run once as the owner role), but the compose file never referenced ${AUTO_MIGRATE}, so the backend entrypoint defaulted back to true and attempted DDL as the unprivileged app role. The value is now plumbed through.
  • Owner-password consistency + staged boot. The install secret block is now idempotent (POSTGRES_PASSWORD is the single source of truth for the owner password, never rotated on re-run), and boot is staged (postgres+redis+backend → wait /health → owner-role alembic upgrade head → wait /health/ready → full fleet) so the worker's depends_on backend: service_healthy no longer deadlocks under AUTO_MIGRATE=false.
  • Dev backend image now auto-migrates. The dev image (Dockerfile) had a CMD but no ENTRYPOINT, so it skipped docker-entrypoint.sh and never ran its migration — leaving /health/ready at 503 and the backend permanently unhealthy. It now carries the entrypoint like the production image.

Security​

  • python-multipart 0.0.30 → 0.0.31 — picks up the fix for CVE-2026-53540. Ships in the backend image.

Upgrade notes​

  • No action required, no migrations. This is a fixes-only patch; the schema is unchanged from v0.13.0.
  • Fresh L1 installs should use v0.13.1. A from-scratch role-separated install at v0.13.0 could fail to provision trustedoss_app or deadlock on boot — both are fixed here. Existing, already-running v0.13.0 stacks are unaffected.
  • Pull the 0.13.1 images (or helm upgrade to the 0.13.1 image tag).