​

Version 2.10.0 Release Notes

​

Overview

​

Key Highlights

​

Security Enhancements

​

Vulnerability Fixes

​

Encryption System Overhaul

// Old system (deprecated)
bcrypt.hash(password, 10)

// New system
argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 65536,
  timeCost: 3,
  parallelism: 4
})

• Automatic migration of existing passwords on next login
• Secure token generation for password resets
• Enhanced session management with rolling tokens
• Encrypted storage for API keys and sensitive configuration

​

Content Security Policy

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'unsafe-inline' 'unsafe-eval';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  connect-src 'self' wss: https:;

​

Performance Improvements

​

Database Optimizations

​

New Indexes Added

-- User lookup optimization
CREATE INDEX idx_users_email ON users(email);
CREATE INDEX idx_users_username ON users(username);

-- Server discovery optimization
CREATE INDEX idx_servers_profile_uuid ON mcp_servers(profile_uuid);
CREATE INDEX idx_shared_servers_is_public ON shared_servers(is_public);

-- Document search optimization
CREATE INDEX idx_docs_project_profile ON docs(project_uuid, profile_uuid);
CREATE INDEX idx_docs_created_at ON docs(created_at DESC);

​

Bundle Size Reduction

​

Memory Management

• Fixed memory leaks in WebSocket connections
• Implemented connection pooling for database
• Added garbage collection hints for large operations
• Optimized React component re-renders

​

New Features

​

Simplified Custom Instructions UI

• Cleaner Layout: Removed clutter and improved spacing
• Better Validation: Real-time validation with helpful error messages
• Auto-save: Changes are automatically saved as you type
• Templates: Pre-built instruction templates for common use cases

​

Enhanced Error Handling

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid input provided",
    "details": {
      "field": "email",
      "issue": "Invalid email format"
    }
  },
  "timestamp": "2025-01-27T12:00:00Z",
  "requestId": "req_abc123"
}

​

Improved Loading States

• Skeleton loaders for better perceived performance
• Progressive content loading
• Optimistic UI updates
• Background refresh indicators

​

Breaking Changes

1. API Authentication: Bearer tokens now require Bearer prefix
2. Password Requirements: Minimum 12 characters (up from 8)
3. Session Duration: Reduced to 7 days (from 30 days)
4. Rate Limits: Stricter limits on authentication endpoints

​

Migration Guide

​

For Users

• Migrate your password on next login
• Update your session tokens
• Apply new security settings

​

For Developers

// Old
headers: { 'X-API-Key': apiKey }

// New
headers: { 'Authorization': `Bearer ${apiKey}` }

try {
  const response = await api.call();
} catch (error) {
  if (error.code === 'RATE_LIMITED') {
    // Handle rate limiting
  }
}

// Minimum 12 characters, 1 uppercase, 1 lowercase, 1 number
const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{12,}$/;

​

For Self-Hosted Instances

# Backup your database first
pg_dump pluggedin_prod > backup.sql

# Run migrations
pnpm db:migrate

# Run encryption migration
pnpm migrate:encryption

# Restart the application
systemctl restart pluggedin

​

Bug Fixes

• Fixed race conditions in concurrent server discovery
• Resolved memory leaks in real-time connections
• Fixed infinite loop in recursive document processing
• Corrected timezone handling in activity logs
• Fixed file upload size validation
• Resolved OAuth state management issues
• Fixed duplicate notification delivery
• Corrected collection sharing permissions

​

Technical Details

​

Dependencies Updated

​

Performance Metrics

• Page Load Time: 2.1s → 1.2s (43% faster)
• API Response Time: 150ms → 45ms (70% faster)
• Database Queries: 500ms → 50ms (90% faster)
• Bundle Size: 2.4MB → 1.4MB (40% smaller)
• Memory Usage: 512MB → 320MB (37% reduction)

​

Known Issues

• OAuth redirect may fail on Safari with strict privacy settings
• Large document uploads (>50MB) may timeout on slow connections
• Search indexing may lag during high traffic periods

​

Future Improvements

• WebAuthn/Passkey support
• Advanced threat detection
• Real-time collaboration features
• Enhanced mobile app
• GraphQL API endpoint

​

Support

• Documentation: docs.plugged.in
• GitHub Issues: Report issues
• Security Issues: security@plugged.in

​

Acknowledgments

• The security research community for responsible disclosure
• Our beta testers for performance testing
• Contributors who helped with the security audit