What's New

Memory System Phase 3 & 4: Proactive Injection + Collective Memory

This release completes the 4-phase memory system overhaul, transforming memory from a passive search archive into an active context-recovery system.

Phase 3: Proactive Injection

• GET /api/memory/resume — New endpoint that runs parallel searches across procedures, longterm, and shocks rings and returns a compact <memory-context> brief ready for session-start injection
• Context brief is injected automatically at session start via the pluggedin-plugin hooks
• Pre-tool-use warnings surface relevant procedures before high-risk operations (migrations, git push, rm -rf, kubectl, docker)

Phase 4: Collective Memory (CBP) Cron

• scripts/setup-memory-cron.sh — Install script for 3 memory maintenance cron jobs:
  • Every 15 min: classify fresh observations into memory rings via LLM analytics agent
  • Daily 3am: promote individual memories to collective gut patterns (CBP)
  • Daily 4am: decay engine, cleanup forgotten memories and expired sessions

Server-Side PII Scrubbing

• Layer 2 defence: addObservation() now strips PII via stripPII() before any DB write
• Complements the hook-side Python scrubber (Layer 1)

Security Fixes

• resume endpoint: generic error response in catch block (no internal details leaked)
• resume endpoint: </memory-context> stripped from memory content to prevent prompt injection
• setup-memory-cron.sh: CRON_SECRET/BASE_URL validated for unsafe shell metacharacters
• Fixed BASE_URL referenced before assignment (set -u would abort the script)
• Fixed %{http_code} unescaped in crontab entries (% = newline in cron)
• Fixed curl -o truncating log file on every run (changed to -o /dev/null)

Bug Fixes

• Memory search failures now logged server-side instead of silently ignored
• Added success: false to 429 responses for consistent error envelope
• Extracted formatSnippet() helper to centralize content sanitization and truncation

Full Changelog

v3.2.0...v3.3.0

What's New

Jungian Intelligence Layer

Four cognitive capabilities inspired by Jungian psychology, layered on top of the existing memory ring architecture:

Synchronicity Detection

Temporal co-occurrence analysis across anonymized profiles. Discovers patterns invisible to individual users:

• Co-occurrence: "After using file_read, users frequently use file_write"
• Failure correlation: Time-of-day and tool-specific failure clustering
• Emergent workflows: Common 3-step tool sequences (e.g., search → read → write)

Uses TABLESAMPLE BERNOULLI for efficient sampling on large datasets with privacy-preserving profile_hash (HMAC-SHA256).

Dream Processing

Batch memory consolidation inspired by sleep cycles. Runs during off-peak hours:

• Clusters semantically similar memories using cosine similarity (configurable threshold)
• Merges redundant memories while preserving distinct insights
• Discovers cross-memory connections that weren't visible in real-time
• Advisory lock protection prevents concurrent processing

Archetype-Driven Behavior

Context-aware pattern delivery using four Jungian archetypes:

• Shadow: Surfaces failure patterns and error recovery strategies
• Sage: Delivers validated knowledge and best practices
• Hero: Provides workflow guidance and procedural steps
• Trickster: Suggests creative alternatives after consecutive failures

Deterministic weight calculation based on context (outcome, observation type, failure count) — no LLM calls, fully predictable.

Individuation Metrics

Per-profile maturity scoring (0–100) across four dimensions:

• Memory Depth (0–25): Ring diversity, decay survival, shock recovery
• Learning Velocity (0–25): Weekly rate, relevance quality, reinforcement
• Collective Contribution (0–25): CBP promotions, pattern diversity, feedback
• Self-Awareness (0–25): Search usage, access engagement, dream consolidation

Five maturity levels: nascent → developing → established → mature → individuated.

MCP Tools (@pluggedin/pluggedin-mcp-proxy v2.1.0)

• pluggedin_memory_search_with_context — Archetype-enhanced memory search that returns personal memories + collective patterns filtered through Shadow/Sage/Hero/Trickster based on context
• pluggedin_memory_individuation — Get individuation score with component breakdown, trend, and personalized tips

Claude Code Plugin (pluggedin-plugin)

• PreToolUse hook: Archetype-routed pattern injection before tool execution
• PostToolUse hook: Temporal event recording for synchronicity detection
• SessionStart hook: Individuation score display on session start

SEO Improvements

• www → non-www permanent redirect (fixes duplicate canonical issues)
• Public user profiles added to sitemap (/to/{username})
• Blog slug typo redirect fix

Technical Details

• Database: 3 new tables (temporal_events, dream_consolidations, individuation_snapshots) with partial indexes
• Privacy: All cross-profile analysis uses anonymized profile_hash, never raw UUIDs
• Security: 8 rounds of code review hardening (PR #139) — race condition fixes, batched deletions, SQL injection prevention, CHECK constraints
• Performance: TABLESAMPLE BERNOULLI sampling, batched 10k-row deletions, advisory locks, in-memory LRU cache for individuation scores
• Configuration: All thresholds configurable via environment variables with clamped bounds
• Tests: 32 unit tests covering archetype routing, individuation helpers, synchronicity formatting, and constants validation
• Migration: pnpm db:generate && pnpm db:migrate (single consolidated migration 0096_shiny_scream)

Ecosystem Versions

Full Changelog: v3.1.0...v3.2.0

What's New

Claude Code Plugin

Native MCP plugin for Claude Code. All your tools, knowledge base, memory, and notifications available directly in your coding workflow — zero configuration. Add plugged.in to Claude Code in seconds.

Collective Best Practices (CBP) System

Privacy-preserving pattern aggregation that learns from all users while protecting individual data. Successful workflows, error recovery patterns, and tool sequences are anonymized, hashed (HMAC-SHA256), and shared only when observed by ≥3 unique profiles (k-anonymity).

Concentric Memory Rings

Human cognition-inspired memory architecture with intelligent forgetting:

• Fresh Memory → observation buffer with auto-classification
• Procedures → repeatable workflows and how-tos
• Practice/Habits → successful patterns reinforced over time
• Long-term → validated insights (requires success_score ≥ 0.7)
• Shocks → critical failures that bypass decay (never forgotten)

Shared Vector Infrastructure

• pgvector integration for semantic similarity search across all memory types
• Cosine distance with HNSW indexing for fast retrieval
• Progressive retrieval (3-layer) for 10x token efficiency

AI Provider Abstraction

• Google Gemini support via @google/genai SDK
• Unified embedding service with automatic provider routing
• Configurable embedding dimensions (default: 1536)

Technical Details

• Privacy: HMAC-SHA256 pattern hashing, k-anonymity (k≥3), no PII in collective store
• Decay Engine: Full → Compressed → Summary → Essence → Forgotten (configurable schedules)
• Database: 4 new tables (memory_sessions, fresh_memory, memory_ring, gut_patterns)
• Security: 6 rounds of code review hardening (PR #138)
• Migration: pnpm db:generate && pnpm db:migrate

Landing Page Updates

• Added Claude Code plugin feature card and references across all sections
• Updated tools pillar to highlight native Claude Code integration
• Updated memory pillar to reflect CBP system
• New v3.1.0 milestone on roadmap
• All 6 locales updated (en, tr, zh, hi, ja, nl)

Full Changelog: v3.0.0...v3.1.0

Breaking Changes

This is a major architectural shift that eliminates the external plugged_in_v3_server (FastAPI + Milvus) dependency for RAG. Document processing and vector search now run in-process using the embedded zvec vector engine backed by RocksDB with HNSW indexes.

Migration Notes

• Docker image changed: docker-compose.yml now uses pgvector/pgvector:pg18 instead of stock postgres:18-alpine. Back up your database before upgrading.
• New env vars: ZVEC_DATA_PATH, EMBEDDING_MODEL, RAG_SEARCH_TOP_K, RAG_CACHE_TTL_MS, ZVEC_ALLOW_EXTERNAL_PATH (see .env.example)
• Removed env vars: RAG_API_URL is no longer used
• Database migration: 3 new migrations (0091–0093) add the document_chunks table. Run pnpm db:migrate after upgrading.
• New dependency: @zvec/zvec requires native build tools (cmake, g++) — included in the updated Dockerfile.

What's New

Embedded RAG Vector Engine (PR #134)

• In-process vector search via zvec (RocksDB + HNSW) — eliminates external HTTP dependency and SSRF attack surface
• Shared vector infrastructure (lib/vectors/) with domain-based collections for RAG, Memory, and future CBP systems
• Server-side PDF text extraction using unpdf — no external service needed
• Smart text chunking with configurable overlap and separators (lib/rag/chunking.ts)
• Shared embedding service using @langchain/openai with model-to-dimension validation
• Re-index menu option in the library UI for recovering from vector corruption
• Relevance-ordered search results with query term highlighting in AI search answers

Security & Robustness

• Filter injection prevention: Field-name allowlist + per-type value validation (UUID regex for UUID fields, alphanumeric regex for string fields) in buildFilter()
• Path traversal protection: ZVEC_DATA_PATH outside app root now blocked unless ZVEC_ALLOW_EXTERNAL_PATH=true
• Corruption recovery: Unhealthy indexes detected via completeness threshold; collections backed up to .bak before recreation with full stats logging
• Idempotent document processing: processDocument cleans existing chunks before re-inserting, preventing orphaned rows and unique constraint violations
• Embedding dimension validation: Model-to-dimension map throws on misconfigured EMBEDDING_MODEL
• HMR safety: zvec collection handles persisted on globalThis to survive Next.js hot module reloads without RocksDB lock conflicts

Removed (Dead Code Cleanup)

• UploadProgressContext, UploadProgressToast, UploadProgress component (~750 lines) — upload polling infrastructure no longer needed with synchronous processing
• /api/upload-status/[uploadId] API route
• getUploadStatus server action stub
• UploadProgress and UploadProgressState types from types/library.ts

Test Coverage

• 28 RAG tests: chunking (5), service (8), schema (2), buildFilter injection prevention (13)
• Vector service, embedding service, and types tests

Files Changed

New files: lib/vectors/ (5 files), lib/rag/ (4 files), tests/rag/ (4 files), tests/vectors/ (3 files), 3 DB migrations
Deleted files: UploadProgress.tsx, upload-progress-toast.tsx, UploadProgressContext.tsx, upload-status API route, types/library.ts (upload types)
Modified: lib/rag-service.ts (full rewrite), app/actions/library.ts, docker-compose.yml, Dockerfile, next.config.ts, 6 locale files

Full Changelog

v2.21.0...v3.0.0

Security Fixes

High Severity Vulnerabilities Fixed

• CVE-2026-0621: Fixed ReDoS vulnerability in @modelcontextprotocol/sdk by updating to v1.25.2
• CVE-2025-15284: Fixed DoS vulnerability in qs package via arrayLimit bypass by adding pnpm override for v6.14.1

Features

GitHub Stars API Proxy

• Added /api/github/stars endpoint to proxy GitHub API calls
• Implemented 5-minute cache to reduce rate limiting issues
• Support for GITHUB_TOKEN/GITHUB_PAT for authenticated requests
• Updated useGithubStars hook to use internal API

Changes

• Updated @modelcontextprotocol/sdk from 1.24.3 to 1.25.2
• Added pnpm override for qs@<6.14.1 to ensure patched version
• Fixed type check in opensource.tsx for stars display

v2.20.0 - Memory Clipboard: The Crossroads for AI Data Exchange

This release introduces Memory Clipboard, a persistent storage system that turns Plugged.in into the crossroads for AI data exchange. Store data from Claude, access it from Python. Save results from Cursor, retrieve them in Go. Your AI agents can finally persist state across sessions and platforms.

✨ New Features

Memory Clipboard - Persistent AI Agent Storage

Your AI agents can now store and retrieve data across sessions - text, JSON, images, code snippets, and more.

Storage Types:

• Named entries - Key-value storage like clipboard["api_response"]
• Indexed arrays - Stack-based storage with push and pop operations
• 2MB per entry - Plenty of room for images and large JSON payloads

Supported Content Types:

• text/plain - Plain text and notes
• application/json - API responses, configs, structured data (with syntax highlighting)
• image/png, image/jpeg, image/webp, image/gif - Images with thumbnail previews
• text/markdown - Formatted documentation
• text/x-code - Code snippets in any language
• Any custom MIME type you need

Multiple Access Methods:

Source Tracking

Every clipboard entry now tracks its origin with a source field:

• ui - Created via web interface
• sdk - Created via JavaScript, Python, or Go SDK
• mcp - Created via MCP proxy tools

Perfect for auditing complex multi-agent workflows!

File Upload Support

• Drag & Drop file uploads in the Clipboard Memory UI
• Support for images, PDFs, JSON, and text files (up to 256KB via UI)
• Image preview for uploaded image files
• Auto-detection of content type and base64 encoding

Visual Dashboard

The Memory section now includes:

• Grid and table view modes
• Image thumbnails with full-size preview modal
• JSON syntax highlighting
• Content type badges
• Expiration countdown display
• One-click copy to clipboard
• Bulk delete and clear all options

Garbage Collection

• Cleanup endpoint (/api/clipboard/cleanup) ready for cron scheduling
• Automatically deletes expired entries (default 24h TTL)
• Monitoring endpoint to check cleanup stats

🛠️ MCP Tools Added

🔐 Security

• Profile-level isolation - Your data never leaks to other users
• Rate limiting - 60 writes/min, 100 reads/min, 30 deletes/min
• Content validation - Encoding verification with actual decode check
• Database constraints - CHECK constraints for data integrity
• Visibility controls - Private, workspace, or public access levels

📦 SDK Examples

// JavaScript/TypeScript
const entry = await client.clipboard.set({
  name: 'api_response',
  value: JSON.stringify(data),
  contentType: 'application/json'
});
console.log(entry.source); // 'sdk'

# Python
entry = client.clipboard.get(name="api_response")
print(entry.source)  # 'sdk'

// Go
entry, _ := client.Clipboard.GetByName(ctx, "api_response")
fmt.Println(entry.Source) // "sdk"

🌍 Internationalization

Full translations for all 6 languages: English, Turkish, Chinese, Hindi, Japanese, Dutch

📚 Documentation

• SDK Docs: https://docs.plugged.in/sdks
• Full Changelog: v2.19.0...v2.20.0

🔒 Security Hardening Release

This release focuses on critical security improvements for authentication and password management, along with significant code quality enhancements.

🛡️ Security Fixes

High Priority

• Server Action Authorization - Fixed server actions that previously trusted client-supplied user IDs
  • getConnectedAccounts() and removeConnectedAccount() now derive user ID from session
  • Prevents unauthorized account enumeration and OAuth provider disconnection
  • All user operations now validate session on every request

Medium Priority

• Email Uniqueness Enforcement - Added database-level unique constraint on users.email

  • Migration 0075_burly_dakota_north.sql adds users_email_unique constraint
  • Prevents duplicate account creation for same email address
  • Eliminates ambiguous login/verification/reset flows

• Race Condition Prevention - Implemented transactional registration with row-level locking

  • Uses SELECT FOR UPDATE to lock rows during concurrent access
  • Atomically deletes unverified users and inserts new ones in single transaction
  • Prevents race conditions that could create duplicate accounts or DoS pending verifications
  • Blocks replacement of verified users and users with OAuth accounts

Additional Security

• CSRF Protection - Added CSRF validation to all password management endpoints

  • Password set, change, and remove operations require CSRF token
  • Prevents cross-site request forgery attacks

• Email Notifications - Security alerts for all password operations

  • Users notified when password is set, changed, or removed
  • Includes IP address, device info, and timestamp
  • Warnings for unauthorized access attempts

🏗️ Code Quality Improvements

Centralized Configuration

• lib/auth-constants.ts - Single source of truth for authentication constants
  • BCRYPT_COST_FACTOR (14) with detailed rationale
  • Shared Zod schemas: passwordSchema, setPasswordSchema, changePasswordSchema, removePasswordSchema, registerSchema
  • Eliminates duplication across registration and password routes

DRY Email Templates

• lib/email-layout.ts - Reusable email HTML scaffolding (~400 lines saved)
  • wrapEmailLayout() - Consistent email wrapper
  • createSecurityInfoBox() - Security details display
  • createWarningBox() - Warning message formatting
  • createActionButton() - Styled button links
  • createProviderList() - OAuth provider lists

Server Action Utilities

• lib/server-utils.ts - Common helpers to reduce boilerplate
  • requireSessionUserId() - Session validation
  • requireUser() - User fetching with optional relations
  • wrapServerAction() - Standardized error handling
  • requireEmailMatch() - Email confirmation validation
  • requireAlternativeLoginMethod() - Login method validation

✨ New Features

Password Management for OAuth Users

• OAuth-only users can now add passwords to their accounts
• Users with passwords can remove them if they have alternative login methods
• Prevents users from being locked out (requires at least one login method)

Enhanced Settings UI

• LoginMethodsCard component - Unified view of all authentication methods
• RemovePasswordDialog - Confirmation dialog with email verification
• Shows connected OAuth providers and password status
• Clear visual indication of login methods

🧪 Testing

New Test Suites

• tests/security/password-management.test.ts - Password operations testing
• tests/security/server-action-auth.test.ts - Session-based authorization tests
• tests/security/email-uniqueness-race-conditions.test.ts - Database constraint and race condition tests
• tests/security/csrf-protection.test.ts - CSRF validation tests

Test Coverage

• 65 security tests across 4 test files
• Tests for authentication, authorization, and data integrity
• Attack scenario testing (enumeration, privilege escalation, DoS prevention)

📝 Database Changes

Migration Required

• Run pnpm db:migrate to apply email uniqueness constraint
• Migration: drizzle/0075_burly_dakota_north.sql
• Adds UNIQUE constraint on users.email column

🌍 Internationalization

New Translation Keys (6 languages: en, tr, zh, hi, ja, nl)

• Password management UI strings
• Login methods card labels
• Error messages for password operations
• Security notification messages

🔧 Technical Details

API Endpoints

• POST /api/settings/password/set - Add password to OAuth-only account
• POST /api/settings/password/remove - Remove password (requires OAuth backup)
• POST /api/settings/password - Change existing password (enhanced with notifications)

Rate Limiting

• Sensitive operations: 10 requests per hour
• Auth operations: 5 requests per 15 minutes
• Prevents brute force attacks

📦 Dependencies

No new dependencies added. All improvements use existing packages.

⚠️ Breaking Changes

None. All changes are backward compatible.

🙏 Credits

Security vulnerabilities identified and fixed through comprehensive code review and testing.

📚 Documentation

For more information about password management features, see the Settings Documentation.

Full Changelog: v2.18.0...v2.19.0

v2.18.0 - OAuth 2.1 Implementation with Token Refresh 🔐

This release implements full OAuth 2.1 compliance for MCP server authentication, including automatic token refresh, RFC 9728 discovery, and dynamic client registration.

🎯 Major Features

OAuth 2.1 Full Implementation

• OAuth 2.1 Specification Compliance: Complete implementation of OAuth 2.1 standards
• Automatic Token Refresh: Tokens are automatically refreshed before expiration
• Token Rotation: OAuth 2.1 refresh token rotation for enhanced security
• PKCE (Proof Key for Code Exchange): SHA-256 code challenge support for secure flows
• State Parameter Binding: HMAC integrity hash to prevent tampering
• Short-lived States: 5-minute state expiration (OAuth 2.1 requirement)

RFC 9728 OAuth Server Metadata Discovery

• Automatic discovery of OAuth endpoints from MCP servers
• Supports WWW-Authenticate header-based discovery
• Falls back to .well-known/oauth-authorization-server discovery
• Stores discovered configuration for future use
• Files: lib/oauth/rfc9728-discovery.ts

RFC 7591 Dynamic Client Registration

• Automatic client registration with OAuth providers
• Reuses existing client credentials when available
• Supports confidential and public client types
• Stores client credentials securely (encrypted)
• Files: lib/oauth/dynamic-client-registration.ts

Token Management

• Encrypted Token Storage: All tokens encrypted at rest (AES-256-GCM)
• Token Expiration Tracking: Automatic detection of expired tokens
• Refresh Token Support: Long-lived refresh tokens for continuous access
• Scope Management: Tracks and validates OAuth scopes
• Database Tables:
  • mcp_server_oauth_tokens - Encrypted token storage
  • mcp_server_oauth_config - OAuth configuration per server
  • oauth_pkce_states - PKCE state management (5-minute TTL)

🔐 Security Enhancements

SSRF Protection

• Comprehensive validation of all OAuth URLs
• Blocks private IP ranges and localhost
• Prevents access to cloud metadata endpoints
• Rate-limited endpoint probing (max 2 attempts)
• Files: lib/oauth/ssrf-protection.ts

Race Condition Protection

• Optimistic locking for token updates with version field
• Prevents concurrent token refresh conflicts
• Detects and reports race conditions
• Migration: drizzle/0074_gifted_fallen_one.sql

Error Sanitization

• Production-safe error messages
• Prevents information disclosure
• Development mode preserves debugging details
• Files: lib/oauth/error-sanitization.ts

Reduced Attack Surface

• Timeouts reduced to 3-5 seconds
• HTTP Basic Auth for confidential clients (RFC 6749)
• User-scoped PKCE states (prevents OAuth hijacking)
• Integrity hash binding for state parameters

📊 Database Schema Changes

New Tables

-- OAuth tokens (encrypted storage)
CREATE TABLE mcp_server_oauth_tokens (
  uuid UUID PRIMARY KEY,
  server_uuid UUID REFERENCES mcp_servers(uuid),
  access_token_encrypted TEXT NOT NULL,
  refresh_token_encrypted TEXT,
  token_type TEXT DEFAULT 'Bearer',
  expires_at TIMESTAMP,
  scopes TEXT[],
  version INTEGER DEFAULT 1,  -- NEW: Optimistic locking
  created_at TIMESTAMP,
  updated_at TIMESTAMP
);

-- OAuth configuration (per server)
CREATE TABLE mcp_server_oauth_config (
  uuid UUID PRIMARY KEY,
  server_uuid UUID REFERENCES mcp_servers(uuid),
  authorization_endpoint TEXT NOT NULL,
  token_endpoint TEXT NOT NULL,
  registration_endpoint TEXT,
  client_id TEXT,
  client_secret_encrypted TEXT,
  scopes TEXT[],
  supports_pkce BOOLEAN DEFAULT true,
  discovery_method TEXT
);

-- PKCE states (5-minute TTL)
CREATE TABLE oauth_pkce_states (
  state TEXT PRIMARY KEY,
  server_uuid UUID REFERENCES mcp_servers(uuid),
  user_id TEXT NOT NULL,  -- Binds to user
  code_verifier TEXT NOT NULL,
  redirect_uri TEXT NOT NULL,
  integrity_hash TEXT NOT NULL,  -- HMAC binding
  expires_at TIMESTAMP NOT NULL
);

Migration Required

pnpm db:migrate

🔄 OAuth Flow

For STREAMABLE_HTTP/SSE Servers:

1. Discovery: RFC 9728 metadata discovery from server
2. Registration: Dynamic client registration (if supported)
3. Authorization: User redirected to authorization endpoint
4. PKCE: SHA-256 code challenge generated and verified
5. Token Exchange: Authorization code exchanged for tokens
6. Storage: Tokens encrypted and stored in database
7. Refresh: Automatic token refresh before expiration

Supported Discovery Methods:

• rfc9728 - RFC 9728 OAuth Server Metadata
• www-authenticate - WWW-Authenticate header parsing
• manual - Manual configuration

📁 New Files

OAuth Core:

• lib/oauth/rfc9728-discovery.ts - RFC 9728 metadata discovery
• lib/oauth/dynamic-client-registration.ts - RFC 7591 registration
• lib/oauth/oauth-config-store.ts - Configuration management (5-min cache)
• lib/oauth/integrity.ts - HMAC integrity hash generation
• lib/oauth/pkce-cleanup.ts - Expired state cleanup

Security:

• lib/oauth/ssrf-protection.ts - SSRF validation
• lib/oauth/error-sanitization.ts - Error sanitization

API Routes:

• app/api/oauth/callback/route.ts - OAuth callback handler

Database:

• drizzle/0074_gifted_fallen_one.sql - Version field migration

🎯 Server Type Support

🔄 Upgrade Instructions

1. Pull latest changes:

   git pull origin main

2. Install dependencies:

   pnpm install

3. Apply database migration:

   pnpm db:migrate

4. Restart application:

   pnpm build
   pnpm start

5. Configure OAuth (optional):

   OAUTH_CLIENT_ID=your-client-id  # Fallback if registration fails
   NEXTAUTH_URL=https://your-domain.com  # Required for redirects

🔍 Testing OAuth Flow

1. Add an MCP server that requires OAuth (e.g., Linear, GitHub)
2. Click "Authenticate" button when server returns 401
3. Complete OAuth flow in browser
4. Tokens are automatically refreshed
5. Check logs for [OAuth] entries

📊 Monitoring

Monitor these log patterns:

• [OAuth] RFC 9728 discovery successful
• [OAuth] PKCE enabled for OAuth flow
• [OAuth] Using HTTP Basic Authentication
• [OAuth SSRF] - Blocked SSRF attempts
• Token was updated by another request - Race condition detected

⚠️ Breaking Changes

None. All changes are backward compatible. Existing mcp-remote OAuth flows continue to work.

🙏 Credits

OAuth 2.1 implementation follows:

• RFC 6749: OAuth 2.0 Authorization Framework
• RFC 7636: Proof Key for Code Exchange (PKCE)
• RFC 7591: OAuth 2.0 Dynamic Client Registration
• RFC 8707: Resource Indicators for OAuth 2.0
• RFC 9728: OAuth 2.0 Authorization Server Metadata
• OAuth 2.1 Draft: Latest security best practices

Full Changelog: v2.17.0...v2.18.0

Release Notes - v2.17.0

Release Date: November 2, 2025

🎉 Major Features

🐳 Multi-Architecture Docker Support

The biggest update in this release! Plugged.in now officially supports both AMD64 and ARM64 architectures.

What This Means For You:

• ✅ Works on Apple Silicon (M1/M2/M3) natively - no more performance issues!
• ✅ AWS Graviton support - cost-effective cloud deployments
• ✅ Raspberry Pi 4+ - run Plugged.in on ARM devices
• ✅ Traditional x86/AMD64 - full compatibility maintained
• ✅ Automatic platform detection - Docker pulls the right architecture for your system

Docker Hub Official Images

Pre-built multi-architecture images are now available on Docker Hub:

# Automatically pulls the correct architecture for your platform
docker pull veriteknik/pluggedin:latest
docker pull veriteknik/pluggedin:v2.17.0

Verify multi-arch support:

docker manifest inspect veriteknik/pluggedin:latest
# Shows manifests for both linux/amd64 and linux/arm64

🐛 Critical Bug Fixes

Fixed: Self-Hosted Registration Issue (#61)

Problem: New users couldn't register on self-hosted instances due to missing username column.

Solution: Added robust migration (0066_fix_missing_username.sql) that:

• ✅ Safely adds the username column
• ✅ Creates proper indexes for performance
• ✅ Adds unique constraints
• ✅ Works for both fresh installs and existing databases

Impact: Self-hosted instances can now successfully register new users without errors.

🔒 Security Enhancements

Docker Build Security

1. Pinned GitHub Actions to commit SHAs - Prevents supply chain attacks

   • All third-party actions now use immutable commit references
   • Mitigates risk of backdoor injections

2. Input Validation - Workflow inputs validated before execution

   • Version format must match latest or vX.Y.Z
   • Prevents malformed builds

3. Improved Error Handling

   • Docker login failures exit immediately with clear messages
   • Platform detection errors caught early
   • Build failures don't corrupt existing tags

⚡ Performance & Infrastructure

Optimized Docker Build Process

1. Ephemeral Builders for CI

   • Auto-cleanup prevents state pollution
   • Uses latest BuildKit for better performance

2. Improved Build Cache

   • Changed from mode=max to mode=min to prevent unbounded growth
   • Faster subsequent builds while managing disk space

3. Manifest Verification

   • Automatically verifies both architectures are present
   • Fails fast if platforms are missing

Expected Build Times

• Single architecture (local): 5-10 minutes
• Multi-architecture (CI): 15-25 minutes (includes QEMU emulation)

📚 Documentation Updates

New Documentation

1. Multi-Architecture Guide (/deployment/docker)

   • Platform verification commands
   • Build and deployment instructions
   • Troubleshooting guide

2. Installation Guide Updates (/quickstart/installation)

   • Docker Hub pre-built images section
   • Architecture-specific notes
   • Simplified quick start

3. README Improvements

   • Docker Compose multi-arch clarification
   • Updated badges and links
   • Build time expectations

Rollback Strategy

Documentation now includes rollback procedures:

# If a build fails, previous tags remain unchanged
docker pull veriteknik/pluggedin:v2.15.0

🛠️ Developer Experience

New Build Script

Enhanced docker-build.sh with:

• Reliable platform detection using docker version -f
• Comprehensive error handling
• Manifest verification after push
• Clear success/failure messages

Usage:

# Multi-arch build and push
./docker-build.sh v2.17.0

# Local build for testing
./docker-build.sh v2.17.0 --local

Automated GitHub Workflows

1. Multi-Arch Build Workflow (.github/workflows/docker-publish.yml)

   • Triggered by tags (v*.*.*) or manual dispatch
   • Builds for both AMD64 and ARM64
   • Verifies manifest before completion

2. Docker Hub README Sync (.github/workflows/docker-hub-readme.yml)

   • Automatically updates Docker Hub description
   • Triggered on README.md changes

📦 What's Included

Docker Architecture

Services:
  - pluggedin-app: Next.js 15 application (multi-arch)
  - pluggedin-postgres: PostgreSQL 18-alpine
  - drizzle-migrate: One-time migration runner

Volumes:
  - pluggedin-postgres: Database data (persistent)
  - app-uploads: User uploaded files (persistent)
  - app-logs: Application logs (persistent)
  - mcp-cache: MCP package cache (persistent)

Supported Platforms:
  - linux/amd64 (Intel/AMD processors)
  - linux/arm64 (Apple Silicon, AWS Graviton, Raspberry Pi)

🔄 Migration Guide

From v2.15.x to v2.17.0

Docker Users (Recommended)

# Stop current containers
docker-compose down

# Pull latest code
git pull origin main

# Rebuild with new multi-arch images
docker-compose up --build -d

Or using Docker Hub:

# Stop containers
docker-compose down

# Pull latest multi-arch image
docker pull veriteknik/pluggedin:v2.17.0

# Start services
docker-compose -f docker-compose.production.yml up -d

Manual Installation

# Pull latest code
git pull origin main

# Install dependencies
pnpm install

# Run migrations (includes username fix)
pnpm db:migrate

# Rebuild and restart
pnpm build
pnpm start

🎯 Breaking Changes

None! This release is fully backward compatible with v2.15.x.

📊 Statistics

• Docker Image Sizes:

  • AMD64: ~450MB (compressed)
  • ARM64: ~440MB (compressed)

• Migration Files: 66 total (added 1 new)

• Supported Architectures: 2 (AMD64, ARM64)

• Supported Languages: 6 (en, tr, zh, hi, ja, nl)

🙏 Contributors

Special thanks to:

• @grota - Reported self-hosted registration issue (#61)
• @simon041988 - Confirmed and helped test the fix
• @justinbadal - Requested multi-architecture support (#84)

🔗 Resources

• Docker Hub: https://hub.docker.com/r/veriteknik/pluggedin
• Documentation: https://docs.plugged.in
• GitHub: https://github.com/VeriTeknik/pluggedin-app
• Issue Tracker: https://github.com/VeriTeknik/pluggedin-app/issues

📝 Full Changelog

Features:

• Multi-architecture Docker support (AMD64 + ARM64) (#105)
• Official Docker Hub images with automated builds
• Docker Hub README auto-sync workflow

Bug Fixes:

• Fixed missing username column preventing registration (#61)
• Fixed platform detection in build script
• Fixed Docker login error handling

Security:

• Pinned GitHub Actions to commit SHAs
• Added workflow input validation
• Improved error handling and early failure detection

Documentation:

• Added multi-architecture deployment guide
• Updated installation instructions
• Added Docker Hub quick start
• Documented build times and rollback procedures

Infrastructure:

• Ephemeral builders for CI (prevents state pollution)
• Optimized build cache strategy
• Automated manifest verification
• Enhanced build script with better error messages

🚀 What's Next?

Stay tuned for v2.17.0 with:

• Enhanced MCP server management
• Performance optimizations
• Additional platform features

Upgrade now to take advantage of multi-architecture support and improved self-hosted reliability!

# Quick upgrade
git checkout main
git pull
docker-compose up --build -d

For questions or issues, visit: https://github.com/VeriTeknik/pluggedin-app/issues

🔒 Security Hardening & Code Quality Release

This release focuses on comprehensive security enhancements and major codebase cleanup, improving the overall security posture from OWASP 88% → 90% and Security Score 8.0 → 9.0.

🔒 Security Enhancements

CSRF Protection

• ✅ Added CSRF validation to document update endpoints
• ✅ Origin validation with referer fallback
• ✅ Custom header enforcement for JSON requests
• 📋 Part of ongoing CSRF protection rollout (PR #103)

Content Security Policy (CSP)

• ✅ Dynamic CSP with per-request nonces
• ✅ Web Crypto API for Edge Runtime compatibility
• ✅ Strict-dynamic directive for enhanced protection
• ⚠️ Requires nginx configuration update (see below)

Authentication & Session Management

• ✅ Bcrypt cost factor: 12 → 14 (16,384 iterations, 4x stronger)
• ✅ Password complexity validation enforced
• ✅ Automatic session invalidation on password change
• ✅ Timing attack mitigation with fixed delays

API Security

• ✅ Document enumeration prevention (generic 404 responses)
• ✅ SQL injection protection (LIKE pattern escaping)
• ✅ Path traversal protection (multiple validation layers)
• ✅ Mass assignment protection (strict field validation)

Security Metrics

• Before: OWASP 88%, Security Score 8.0
• After: OWASP 90%, Security Score 9.0
• Improvement: +2% compliance, +1.0 security score

🧹 Code Quality & Cleanup

Dead Code Removal (-3,597 lines)

• Removed 8 unused exported functions
• Removed 9 unused test utility functions
• Deleted 10 obsolete files from root
• 75% reduction in console.log statements (319 → 80)

Project Organization

• Created /docs directory structure
• Moved 7 documentation files to organized locations
• Cleaner root directory

Dependency Management

• ✅ Added missing glob dev dependency
• ✅ Removed unused pino-pretty dependency
• ✅ Updated lockfiles

Quality Improvements

• Fixed ESLint errors and warnings
• Version synchronization (package.json ↔ README)
• Reviewed all TODO/FIXME comments

🐛 Bug Fixes

• Fixed migration issue preventing user login
• Fixed email field privacy leak in user API
• Bcrypt cost factor consistency (registration ↔ password changes)

⚙️ Infrastructure Requirements

⚠️ Nginx Configuration Update Required

Due to larger CSP headers, update your nginx configuration:

# Add to your server block
proxy_buffer_size       128k;
proxy_buffers           4 256k;
proxy_busy_buffers_size 256k;
large_client_header_buffers 4 32k;

Symptoms without this fix:

upstream sent too big header while reading response header from upstream

Deployment Checklist

• Update nginx configuration
• Reload nginx: sudo nginx -s reload
• Verify CSP headers are working
• Monitor for header size errors in logs

📦 Files Removed

🧪 Testing & Validation

• ✅ Build successful (Next.js 15.5.2)
• ✅ Test coverage: 72% (542/755 tests passing)
• ✅ No breaking changes
• ✅ Production deployment verified

🚀 Upgrade Guide

From v2.15.x

1. Update nginx configuration (see Infrastructure section above)
2. Pull latest changes: git pull origin main
3. Install dependencies: pnpm install
4. Run database migrations: pnpm db:migrate
5. Build: pnpm build
6. Restart application: pm2 restart pluggedin-app (or your process manager)
7. Verify CSP headers: Check browser DevTools → Network

Breaking Changes

None - This is a backward-compatible release.

📊 Impact Summary

👥 Contributors

• @ckaraca - Lead developer
• Claude (AI) - Code assistance & security review

📚 Related

• Pull Request: #103 Security/vulnerability fixes verified
• Full Changelog: v2.15.0...v2.16.0
• Security Policy: See SECURITY.md
• Documentation: See /docs directory

🙏 Acknowledgments

Special thanks to:

• Sourcery AI for automated code review
• OWASP for security guidelines
• The open-source community

Need help? Open an issue or reach out to the team.

Found a security issue? Please report privately to security@plugged.in