v0.46.0
July 12, 2026
A security hardening pass from the latest audit: closed a few isolation gaps between customer tenants on task opening, manual status change and automation initiatives, and made the real-time channel more resilient against a potential overload.
-
Security
Tenant isolation
Task opening. The endpoint that records an operator's first access to a task now always checks that the task belongs to the caller's tenant — it previously read/wrote without that check. Manual status change. The guard that blocks manually selecting an "exception-only" status now only considers statuses of the item's own flow, not a status with the same id from another flow. Automation initiatives. Creating an initiative linked to a process map and a node now verifies that both exist, belong to the right tenant and are consistent with each other — previously accepted with no checks. Runtime event registry. An extra tenant-ownership check on the automatic generation of a flow's system events (timeout/WIP/SLA).
-
Security
A more resilient real-time channel
Connection cap. The real-time update channel (used by lists, dashboards and history) now has a configurable ceiling on simultaneous connections (default 1000), beyond which new connections are cleanly rejected instead of degrading the ones already active. Spread-out resync. After a database connection hiccup, the "reload your data" signal sent to clients is now spread over a short window instead of all at once, avoiding a spike of simultaneous requests on the server.