1.2.0 — The 1.2 line — 71 releases, May to August 2026

2026-05-06

One entry covering the whole 1.2 series rather than 71 separate ones. Predominantly security and hardening work across accounts, auth, DNS and files. Per-release detail through 1.2.64 lives in CHANGELOG.md in the repository; recorded release history starts properly at 1.3.0.

Security

• Geofencing plane: editable system rules, IP allowlist with expiry, simulate mode, and an exemption audit trail.
• Geofence evidence: every block becomes an incident event, with metrics. Per-scope fail posture.
• Login-flow geofencing enforces after credential verification, not before.
• Authenticated-abuse hardening: default per-identity API throttle, traffic-concentration alerts, instant account kill switch, websocket connection limits.
• SECRET_KEY rotation is survivable rather than a data-loss event.
• Filevault access audit trail (VaultAccessLog).

Added

• GitHub OAuth as a hosted-page login and registration method.
• An API key can act as a member (ApiKey member semantics).
• dnsman: batch TLD availability, domain suggestions, and a per-TLD price cache.
• GET /api/dnsman/config — capability discovery for dnsman consumers.
• Incident tickets can be pushed into a remote work board with two-way sync.
• _mode=count gains _stats for batched named counts.
• Configurable outbound webhook signature header and User-Agent.
• create_user management command for bootstrapping admins.
• fileman: SVG thumbnails.

Fixed

Roughly forty fixes across accounts, auth, dnsman, fileman, docit, bouncer and the testit runner. Individually listed in CHANGELOG.md.

Note on this entry

The 1.2 line shipped in 71 small increments over three months. Backfilling one note per patch would bury the releases that matter, so this is a single summary entry — the floor of the recorded history, not a complete account. CHANGELOG.md was maintained through 1.2.64 and frozen when the changelog moved onto the work board.