Security

• Increase minimum DOMPurify version to 2.0.16 due to recent upstream security advisories

Security

• Increase minimum DOMPurify version to 2.0.16 due to recent upstream security advisories

Security

• Increase minimum DOMPurify version to 2.0.6 due to recent upstream security advisories

Security

• Increase minimum DOMPurify version to 2.0.6 due to recent upstream security advisories

Security

• Bump Dockerfile base image to Alpine 3.8.1 to fix an apk remote code execution vulnerability

This will be the last release line to support Node.js 4, 5 and 7.

Improved

• Backport Docker image infrastructure

Fixed

• Backport fix for non-public images always returning 403 Forbidden (#1438)

Changed

• Bump gm version out of caution to pull in a fully security-patched debug

Improved

• Generate startup log warnings on bad configurations, including insecure secret values and internal parameters
• Add a Dockerfile
• Added zero-downtime upgrade support

Changed

• Update deps
• Enable some more tests and start tracking code coverage with Coveralls
• Expand package.json metadata
• Clarify semver-major local modification policy
• Move most documentation to ReadTheDocs (#1496)

Fixed

• bin/pump-import-collection no longer crashes due to an underscore-contrib reference
• Fix the logged-out mobile homepage's menu icon being black (#1445)
• Fix the JavaScript license page not loading Bootstrap properly (#1432)
• Fix some README config options
• SockJS connections no longer fail due to authorization problems (#1475)

Fixed

• Fix the package shipping with .jade.js files built from the 5.0.x releases

Security

• Fix multiple denial-of-service security vulnerabilities in indirect dependencies

Fixed

• connect-auth-pumpio is pulled from npm instead of GitHub again

No changes from 5.0.1 beta 0:

Security

• Fix multiple denial-of-service security vulnerabilities in indirect dependencies

Security

• Fix multiple denial-of-service security vulnerabilities in indirect dependencies

This release was a private beta due to the security fixes being slightly risky for stability.

The relevant security bugs were publicly disclosed on October 1st, 2017.

Security

• Fix multiple denial-of-service security vulnerabilities in indirect dependencies

No changes from 5.0.0 beta 1.

Fixed

• Original posts no longer show "shared by" (#1427)
• Fixed some minor inaccuracies in README.md's documentation of defaults

Changed

• Upgrade to [email protected]

Improved

• Node 7 and 8 are now supported
• Documented the bounce and logLevel config options
• The web UI more clearly shows shares
• Worker process deaths are sent to the error log stream, not the warning stream

Changed

• Removed 0.10/0.12-specific hacks
• Internal refactoring to use newer ES6 features

Fixed

• Fixed crash in an endpoint which prevented "login with remote account" from working (#1281)

Breaking

• Dropped support for Node.js 0.10 and 0.12 (#1234)
• Added a period and space after the footer text; if you use appendFooter please adjust accordingly (#1349)
• Switched from Glyphicons to Font Awesome (affects web UI template modifications) (#1351)
• Upgraded Backbone to 1.3.3 (ditto) (#1382)
• Switched from Underscore to Lodash (ditto) (#1326)
• Enabled many systemd security restrictions in the systemd service file (#1346, #1257)

Improved

• Backported some improved error messages to assist in debugging a bug

Fixed

• Backported fix for crash in an endpoint which prevented "login with remote account" from working (#1281)

No changes from 4.1.0 beta 0. This will be the last release to support Node.js 0.10 and 0.12.