Telemachus 0.12.0 — a security release, and the first tagged versions since 0.4

Telemachus, our privacy-focused AI laboratory for teams, published two releases this week: v0.11.0 on November 10 and v0.12.0 on November 11. If you run an instance, 0.12.0 is the one to install.

Releases are back

Tags had stood at v0.4.0 while the code moved on to 0.11.0. The 0.11.0 release closes that gap and is the first cut under a written release runbook. It names the work from 0.5.0 onward, including email delivery and notifications, org-format notes and the note graph, research bookmarks, the vector store and retrieval, in-product help, voice notes, translation as a job with progress, and a machine-readable OpenAPI description of the routes.

What the audit found

0.12.0 carries the fixes from a November security audit. In plain terms:

• Passwords. New hashes use PBKDF2-HMAC-SHA256 at 600,000 rounds, up from SHA-1 at 100,000. Existing hashes still verify and are replaced the next time their owner signs in, so there is nothing to migrate.
• Uploads. An in-flight chunked upload can now be continued, completed or aborted only by the person who began it. Before, a teammate with write access who held the upload id could complete it and become the owner of the result.
• Key rotation. Rotating the encryption key now rewrites every encrypted column. Thirteen were being skipped, so on an instance with content encryption on, older jobs, workflow runs and translations stopped opening once the previous key was dropped.
• Configuration. The sign-up funnel no longer falls back to a secret from the public source when TMACH_SECRET is unset, and boot warnings now name what is actually at risk.

Follow-ups from the audit that did not make this release are tracked in the open, in issue #282.

Also in 0.12.0

• Notes: .org export and import, and a links graph.
• Workers: stopping a worker hands its job back without spending an attempt.
• Plugins: a route may be declared public and serve its own media type.
• Localization: a locale is offered only when it is translated enough to answer in.

If you are upgrading

Two cases need action:

1. You rotated the encryption key on 0.11.0 or earlier with TMACH_ENCRYPT_CONTENT on, and have dropped the old key. Set TMACH_SECRET_KEY_OLD to it again, upgrade, and re-run telemachus-secrets rewrap.
2. You run more than one replica and never set TMACH_SECRET. Set it, or a sign-up challenge issued by one replica will be refused by another.

The release notes have the full list.

Next

Work has already moved past the tag. A Research tab merged on November 12: an archived bookmark now lists the entities the knowledge graph read from it, and clicking one draws its neighbourhood, limited to what you are allowed to read.