Changelog/v1.3.0.md

Rama main · réplica de lectura del repositorio original.

# Changelog v1.3.0

## Heads up before upgrading

- Screen recording is off by default. Turn it on under **Widget > Recording** in the Admin Console, or per project under **Project Settings > Recording**.
- The server now accepts request bodies up to 256 MB, enough for one maximum-size video (100 MB) plus screenshots. Your reverse proxy must accept uploads up to the configured video size and allow enough time for slower uploads. See the [reverse proxy guide](https://docs.bugpin.io/installation/reverse-proxy).
- The database is updated automatically on first start: new tables for two-factor authentication and passkeys, two new user columns, a submission id on reports, and capture details (time, duration, recording quality) on stored files. Back up `data/` before upgrading.
- Follow the [backup and recovery instructions](https://docs.bugpin.io/upgrading#rolling-back) before upgrading. Recovery requires the previous image and its matching full data backup, including `.secret`; changing only the image does not undo database migrations.
- Admin accounts that still use the initial `ADMIN_PASSWORD` must set a new password at their next sign-in. Until then, their sessions and API tokens can only change the password or sign out.
- Authenticator app secrets are encrypted with the key in `data/.secret`. Back it up with the database: without it, authenticator apps stop working and users must sign in with a recovery code.
- Only the widget API (`/api/widget/*`) answers cross-origin requests now. Scripts that call other endpoints from a browser on another origin need to call them from a server with an API token instead.
- After upgrading, admins see a warning at the top of the Admin Console when the **Application URL** under **Settings** differs from the address in the browser, or when BugPin derives a different address from a request than the browser uses (reverse proxy headers or `TRUST_PROXY`). Future BugPin versions rely on both: they only accept Admin Console changes made from the Application URL, and they read the forwarded host and protocol only from proxies that `TRUST_PROXY` trusts. **Not now** hides a warning for a day, and closing it hides it in that browser until the addresses change. Resolve the warnings before the next major upgrade. See the [upgrade guide](https://docs.bugpin.io/upgrading#address-warnings-in-the-admin-console).
- A future version will reject API requests that contain unknown fields instead of ignoring them. Integrations that send extra fields should drop them now.
- Rate limits use the connection address. Behind a reverse proxy, keep `TRUST_PROXY=auto` (the default, trusts private-network proxies) or set `true`. The quick-start `docker-compose.yml` sets `TRUST_PROXY=false` because it publishes port 7300 directly. See the [reverse proxy guide](https://docs.bugpin.io/installation/reverse-proxy).

## Features

The widget changes in this release, including screen recording, are listed in the [widget changelog v1.2.0](https://github.com/aranticlabs/bugpin/blob/main/Changelog/widget/v1.2.0.md). The bundled `/widget.js` served by BugPin 1.3.0 includes them.

### Recording settings

- New **Widget > Recording** page in the Admin Console with **Enable Screen Recording**, **Video Quality** (Low 720p, Standard 1080p, High 1440p), **Max. Recording Duration** (10 to 600 seconds), **Max. Video Upload Size** (1 to 100 MB), **Daily Video Upload Limit** per project, and **Allow Microphone Recording**.
- Each project can override these settings in a new **Recording** tab in **Project Settings**.
- The server enforces the microphone and duration settings too, so a modified widget cannot bypass them.

### Video playback and GitHub

- Videos play in the report detail with seeking, served through byte-range requests.
- Recordings are remuxed on the server with the new `mediabunny` 1.64.0 dependency (MPL 2.0, listed in `NOTICE`), so browser recordings that lack duration and seek information play correctly.
- GitHub integrations have a new **Public video links** option. When it is on, issues link directly to the video; otherwise they link to the report in the Admin Console. Public links only work for reports sent to that repository and stop working when the option is turned off.
- The daily video upload limit is checked per project over a rolling 24 hours. Reports that exceed it are rejected with a clear message, and buffered offline reports are retried without their video.

### Two-factor authentication and passkeys

- Users can add an authenticator app in **Profile > Security**. The QR code is generated in the browser, and 10 single-use recovery codes are shown once and can be regenerated.
- Passkeys can be added in **Profile > Security** and used to sign in without a password through the new **Sign in with a passkey** button, or as the second step after the password.
- Adding or removing a factor and regenerating recovery codes ask for the current password.
- **Security > Two-Factor** can require a second factor for admins or for all users. Users the policy covers set one up at their next sign-in before they can continue.
- Admins can reset a user's two-factor authentication from **Users**, or with `bun run reset-two-factor <email>`. Both sign the user out of all sessions.

### Password policy

- **Security > Password Policy** sets a minimum length (8 to 128 characters) and can require uppercase letters, lowercase letters, numbers, and special characters.
- The policy applies to every new password: password changes, new users, invitations, admin resets, and `bun run reset-password`. Existing passwords keep working until they are changed.
- The change-password and invitation forms show the rules while typing.

## Changed

- The warning about unsupported widget package versions has the same **Not now** button as the update banner, which hides it for a day.
- BugPin refuses to start on a database that a newer version has already updated. The log names the unknown migrations and any pre-upgrade snapshots stored beside the database. Before, an older version started on such a database and failed later.
- The update banner adapts to the release type. Major releases warn about breaking changes and link to the new [upgrade guide](https://docs.bugpin.io/upgrading), minor releases link to what's new, and patch releases show a quieter bar. **Not now** hides the banner for a day, and closing it hides it for the rest of that release line (every 2.x release for a major update, every 1.4.x release for a minor one, and only that version for a patch).
- The **Security & Privacy** page is now **Security** (`/security`), with the tabs **General**, **Two-Factor**, and **Password Policy**. The EU Privacy Mode settings moved to **Settings > Privacy**. Bookmarks to the old `/security-privacy` address open the dashboard.
- The report detail card for attachments is now titled **Media**, since it holds screenshots and videos. Each item shows when it was captured, its dimensions, size, and for videos the length and recording quality.
- The webhook editor keeps a saved signing secret when the field is left empty, and a new **Remove secret** link deletes it. Before, clearing the field removed the secret.
- Number fields in the screenshot and recording settings keep what you type, flag out-of-range values inline, and only save valid values.
- Turning on **Use Custom Settings** in a project's screenshot or recording settings now copies the inherited values, so the override is saved even if nothing else changes.
- The first admin account is set with `ADMIN_EMAIL` and `ADMIN_PASSWORD` (defaults `admin@example.com` / `changeme123`). The initial password works once, and BugPin asks for a new one after the first sign-in.

## Fixes

- Saving an already resolved or closed report preserves its resolution or closure time and the original resolver.
- Valid Chrome WebM recordings are no longer rejected by the remux step, which left some videos without duration and seeking.
- The daily video quota can no longer be exceeded by uploads that arrive at the same time.
- Video size limits stay editable when screen recording is off, since they also apply to uploaded videos.
- Oversized uploads get a structured error instead of a bare HTTP 413.

## Security

- CORS is limited to the widget API, without credentials. Before, every endpoint accepted cross-origin requests from any site with credentials allowed.
- Static files under `/admin/` and `/branding/` can no longer be read outside their folders through encoded dot segments or separators.
- Rate limits and the addresses recorded for sessions and invitations use the connection address. `X-Forwarded-For` and `X-Real-IP` are only honored from trusted proxies (`TRUST_PROXY`), and IPv6 clients are counted per /64 network.
- Widget submissions are limited per visitor and project instead of per project key, so one visitor can no longer use up a project's limit for everyone.
- Each sign-in endpoint has its own rate limit, and second-factor sign-in is locked for an account for 15 minutes after 10 failed attempts within 15 minutes.
- Authenticator secrets are encrypted at rest (AES-256-GCM), and recovery codes are stored as hashes.
- API tokens are refused while their user must change the password or set up two-factor authentication. A new password must differ from the current one.
- Public video links only serve videos of reports linked to a GitHub issue in a repository whose integration allows them, and browsers cache them for 5 minutes instead of 24 hours, so revoking takes effect quickly.
- The `publicVideoLinks` integration option must be a boolean.
- Webhook API responses no longer include the signing secret. They return `secretSet` instead, which tells whether a secret is saved.
- Remux runs one recording at a time to keep memory use predictable, and range reads from S3 storage are capped at 8 MB per response.

## Maintenance

- HEAD requests for stored files return headers without reading storage.
- Docker images are also tagged with the major and minor version (`1` and `1.3`), so an installation can follow one release line instead of `latest`.
- Widget reports carry a submission id, and the server answers a repeated submission with the existing report instead of creating a second one.