Engine Release Notes

v1.1.0-build.67-channel.stable (stable · latest)v1.1.0-build.116-channel.insider (insider)

insider 2026-10-02 JSON ↗

• Added Initial release of Niksphere Engine
• Added Unified design for device authorization flow UI in IdP Broker matching React SPA frontend
• Added Implement actor and identity architecture with universal admin client access, fail-fast validation, and full OpenAPI documentation
• Added Add configuration-driven admin provisioning (admin_username/admin_password/admin_pat, settable via NIKSPHERE_ENGINE_ADMIN_* environment variables or the engine config file) for self-hosted emergency access and headless CI/CD provisioning
• Added Generate a CycloneDX JSON Software Bill of Materials (SBOM) for each platform binary during the build, covering both the Go module graph and the npm dependencies of the embedded frontends, with exact versions, cryptographic hashes, and licenses
• Added Add GET /admin/sessions and DELETE /admin/sessions/{id} Admin API endpoints to list active Client Runtime sessions (connection id, connected-at timestamp, and the authenticated actor''s id and name) and to forcibly terminate one, for developers building tooling around active app sessions
• Added Add allow_debugging configuration setting (enabled by default, settable via NIKSPHERE_ENGINE_ALLOW_DEBUGGING or the engine config file) to control whether a debugger may be attached to this Engine — intended to be disabled on Production environments
• Changed Optimize database schema migrations by bundling initial table columns directly into table creation and batching subsequent column additions as well as column deletions per table, significantly accelerating app installation and upgrade performance
• Changed Render --help descriptions as formatted Markdown (bold, italic, inline code, lists, syntax-highlighted code blocks) under clear Usage/Description/Flags sections, including clickable links in supporting terminals
• Changed Admin API error messages now consistently start with "Failed to <action>: <reason>", mirroring the existing "Successfully <action>..." convention on success, so the outcome is clear from the first word alone
• Changed Generate a random, per-installation default admin account on a genuinely empty installation (shown once in that startup''s log output) instead of a fixed default
• Changed BREAKING: Split the app manifest author field into publisher (the organization distributing the app) and developer (who wrote it) — renamed in nikapp.yaml, the AppVersion database model, and the author field returned by the Admin API''s app list/upload/publish endpoints
• Fixed Fix the Engine starting with an invalid trusted_proxies setting and silently trusting every proxy; the Engine now refuses to start when an entry is not a valid IP address or CIDR range, or when a range such as 0.0.0.0/0 would trust every client
• Fixed Fix Admin API upload/publish responses nesting the success message under data.message instead of the top level, which caused the CLI and VS Code Extension to show a generic fallback message instead of the server''s actual text
• Fixed Include configured routePrefix in verificationURI and external OAuth2 redirect URLs (IdP Broker)
• Fixed Updated frontend dependencies to resolve security audit vulnerabilities
• Fixed Added HTTP/HTTPS scheme annotations to OpenAPI specification generator for SDK compatibility
• Fixed Return consistent 404 responses for unknown actors, clients, apps, and their sub-resources instead of an empty success or malformed error
• Fixed Apply configured idp_token_expiry_hours / idp_refresh_token_expiry_days settings instead of ignoring them
• Fixed Fix external identity provider login page leaking OAuth client secrets to the browser (IdP Broker)
• Fixed Fix frontend login using an unregistered OAuth client ID
• Fixed Fix Admin API 401 responses (missing/invalid token, inactive client, suspended actor, ...) using a different body shape ({"error": "..."}) than every other response ({"status": "error", "message": "..."}), and document them in the OpenAPI spec; SDK clients can now parse the real reason instead of discarding the response body as an unmapped status code
• Fixed Fix var/out parameters not being passed by true reference; changes made to them inside a routine could silently fail to reach the caller
• Fixed Fix records passed to a routine by value not being copied; modifying such a parameter inside the routine could unexpectedly change the caller''s original record
• Fixed Fix overloaded routines (same name, different parameter types) sometimes being registered twice, which could break compilation or resolve to the wrong overload
• Fixed Fix debugger call stack frames showing "anonymous" instead of the actual routine name
• Fixed Fix debugger not showing global variables while stepping through code, and show them in their own "Globals" section separate from local variables
• Fixed Fix app installation failing during database schema generation with "maximum nesting depth exceeded" when an entity field references an enum that shares its name with a database table
• Security Remove the hardcoded default admin credential (previously identical across every Engine build) in favor of a per-installation randomly generated or explicitly configured administrative account
• Security Close several security vulnerabilities in the web interface (engine console and IdP broker login pages), including denial-of-service and open-redirect issues
• Security Close several security vulnerabilities in the backend server, including TLS/certificate handling and authentication token issues