releases/v0.8.6.md

Rama master · réplica de lectura del repositorio original.

# v0.8.6

**Released:** 2026-08-15

Security-hardening release following a full application audit.

## Security

- Added optional access-token authentication with server-side sessions, token-rotation revocation, login throttling, minimum token entropy, and authenticated Bearer API mutations. Set `FRANKMD_AUTH_TOKEN` to a value generated with `openssl rand -hex 32`; trusted-LAN deployments remain open when it is unset.
- Removed `.fed` from the note tree and blocked direct, encoded, and canonical-alias access through note routes, preventing configuration and credential disclosure. Edit `.fed` directly on disk for non-UI settings.
- Fixed stored DOM XSS in image pickers, file finder, and table editor by making attribute interpolation quote-safe and validating image URL schemes.
- Stripped active CSS from Markdown previews and added CSP, Referrer-Policy, importmap SRI, and CSP-compatible thumbnail fallbacks.
- Hardened filesystem containment for new files below symlinked directories; recursive note walkers now ignore symlinks.
- Made `.fed` creation, updates, and upgrades atomic with mode `0600`, and rejected line/quote injection through UI configuration values.
- Restricted image preview to configured media extensions; bounded regex searches, large-file scans, base64 decoding, and external-image fetch duration.
- Randomized local/S3 object names and added conditional no-overwrite writes for image and media uploads.
- Removed API-key prefix logging and raw upstream AI/image error disclosure.
- Pinned GitHub Actions to reviewed commit SHAs, minimized workflow permissions, tracked the npm lockfile, and added npm/Vitest CI coverage.

## Operations

- Optional `FRANKMD_ALLOWED_HOSTS` enables Rails host authorization and origin checks for known LAN/tunnel hosts.
- Docker Compose now forwards both security variables and no longer injects a public fallback `SECRET_KEY_BASE`.
- Root `.fed` and `.ai-jail` files are excluded from Git/Docker build contexts.

## Test Coverage

- 790 Ruby tests, 1,479 JavaScript tests (2,269 total).