Skip to content

Release v0.2.1

Latest
Latest

Choose a tag to compare

View all tags
@LuD1161 LuD1161 released this 15 Feb 20:52
· 47 commits to main since this release
v0.2.1
9500f70
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ShipSec Studio v0.2.1 — Release Notes

This release strengthens the platform after v0.2 with a focus on MCP reliability, multi-instance isolation, runtime stability, and workflow analytics—plus several UI and workflow-builder improvements.

📦 Docker Images

  • Backend: ghcr.io/shipsecai/studio-backend:0.2.1
  • Frontend: ghcr.io/shipsecai/studio-frontend:0.2.1
  • Worker: ghcr.io/shipsecai/studio-worker:0.2.1

🔐 Security & Access Control

  • Added DOMPurify sanitization to prevent XSS in Markdown rendering. (PR #261)
  • Enforced organization-level access control on human-inputs endpoints. (PR #264)

🧠 MCP & Agent Platform Improvements (Hardening + New Surfaces)

v0.2 introduced the MCP platform; v0.2.1 operationalizes it.

  • Added a global MCP Library to centrally manage MCP servers and their tools. (PR #209)
  • Moved webhook parsing + MCP discovery into the worker and removed backend Docker dependency for discovery. (PR #267)
  • Fixed and hardened the MCP tool discovery/execution pipeline, including agent-tool migration and e2e reorg. (PR #276)
  • Exposed Studio as a Streamable HTTP MCP server, enabling external agents/tools to call Studio directly. (PR #287)

📊 Workflow Analytics

  • Added Workflow Analytics Dashboards with OpenSearch integration. (PR #229)
  • UI: Disable “View Analytics” when no analytics sink is connected. (PR #282)

🧪 Developer Experience: Multi-Instance & Local Setup

  • Added multi-instance development stack with full isolation. (PR #265)

  • Made dev/proxy behavior instance-aware:

    • Instance-aware frontend VITE_API_URL env for pm2 (PR #280)
    • Instance-aware routing + multi-instance commands (PR #284)
    • Derive Vite proxy target from SHIPSEC_INSTANCE (PR #285)

  • Improved local dev compatibility:

    • Bash 3.2 support for dev-instance-manager.sh (PR #268)

  • Fixed config examples:

    • Added missing env vars + fixed key generation in example files (PR #262)

⚙️ Runtime & Worker Reliability

  • Improved workflow execution resource management:

    • Deterministic volume naming, then restored unique per-node volume names where required. (PRs #270, #271)

  • Standardized security tool component distribution:

    • Use GHCR images for all security tool components. (PR #272)
    • Removed sh entrypoint from distroless security components. (PR #283)

  • Backend stability for multi-instance:

    • Added instance-scoped Kafka consumer group + client IDs. (PR #273)

  • Refactors:

    • Renamed cleanupLocalMcpActivity → cleanupRunResourcesActivity. (PR #277)
    • Centralized component category registry across the platform. (PR #288)

🖱️ UI & Workflow Builder Enhancements

  • Workflow list: drag-and-drop reordering. (PR #269)

  • Workflow builder: smooth auto-focus + zoom-out transition. (PR #260)

  • Spotlight: improved command palette selection visibility. (PR #259)

  • UX fixes:

    • Typing fix when entering artifact name (PR #256)
    • Fixed-width config panel sidebar (PR #279)
    • Fixed entry point configuration (PR #246)
    • Workflow import now checks if required secrets exist (PR #258)
    • Removed console log component in favor of i/o (PR #257)

  • Analytics UX: disable View Analytics button when no sink is connected (PR #282)

🧹 Release Engineering

  • Automated version bumping in the release workflow. (PR #289)
  • Version tag UI change was introduced and then reverted. (PRs #254, #255)

Full Changelog: v0.2...v0.2.1

Assets 2
Loading