Releases · Over-the-air updates · Latest 1.0.32

What changed,
and when.

What is in the current release, in full. Servers already running Portalis update themselves from Settings → Update — nothing here has to be downloaded by hand.

# install on a fresh host curl -fsSL https://get.portalis.sh | sudo bash # install one exact version PORTALIS_VERSION=1.0.32 curl -fsSL https://get.portalis.sh | sudo bash # what the Update screen reads https://get.portalis.sh/releases.json

Pinning a version

The installer takes the newest release unless you pin one. Pinning is for reproducing something, or for walking an upgrade yourself: set PORTALIS_VERSION and the installer pulls exactly that image tag. A version that was never published fails before anything is written.

1.0.32Latest

7 fixed3 changed
Fixed
  • Database read-only grants now reject transaction-control commands and multi-statement batches. Queries are prepared as a single statement inside a read-only transaction, preventing a caller from ending the transaction before writing.
  • SSH connections recheck the current account, expiry, role, server status and grants before dialing. An open menu no longer preserves revoked or expired access, and connections use current target details.
  • Repeated or malformed SSH shell/PTY requests are rejected without crashing the gateway or changing an active session's PTY state.
  • Browser and native SSH sessions require a writable recording and a successful session registration. A recording/output failure during the session closes the target connection.
  • HTTP request logs record route patterns instead of full URLs, keeping invitation/reset tokens and SSO codes out of request logs. User-group changes from the Users page now record the actor, target user and resulting group IDs in Activity.
  • Settings and Profile adapt to narrow screens. The main navigation opens as a keyboard-accessible drawer on mobile, settings controls stack, and long SSH fingerprints wrap.
  • Updated the Go toolchain and affected Go/npm dependencies to resolve the security findings in used packages.
Changed
  • Release images are built only after backend regression tests, frontend lint and the frontend build pass. Manual builds update only their version tag by default; updating latest and the minor tag for in-app OTA testing is an explicit workflow option.
  • Inviting someone from outside now takes hours as well as days — 1 to 12 hours, or 1 to 180 days. A supplier who needs two hours should not be handed a whole day because the field only spoke days. Under a day the mail and the dialog name the time, not just the date, since "ends 5 September" reads as end of day when it is really 16:00. Extending works the same way, and the end date is enforced within five minutes either way.
  • The invitation dialog carries the Database switch too, next to browser terminal and file transfer. On a licence without the module it shows as unavailable rather than as an "On" for something they could never open. Note that database access is granted through a user group, so an invited account has none of it to begin with; the switch is a second lock, not the key.