BugPin v1.2.0

BugPin v1.2.0 adds report activity history, selected-report sharing, and an Unassigned assignee filter. It also includes security hardening and an automatic database migration.

Heads Up Before You Upgrade

Report history migration

The release adds a report_history table. The migration runs automatically when BugPin starts for the first time after the upgrade; no manual database step is required.

What's New

Unassigned report filter

The Reports assignee filter now includes Unassigned, allowing you to list reports that do not have an assignee.

Report activity history

Report detail now includes a JIRA-style Activity timeline for report creation, status changes, priority changes, and assignee changes. The history is stored server-side and is available through GET /api/reports/:id/history.

Share selected reports

Bulk actions now include a Share dropdown. Select reports and download a compact export as:

• Excel (.xlsx)
• CSV (.csv)

Shared files contain the report Title, Description, and URL. The URL points to the BugPin report detail page (/admin/reports/:id), so recipients can open the report directly in BugPin.

Fixes

• Report export permalinks now use /admin/reports/:id, matching notification links and the actual Admin Console route.
• Reports list pagination no longer resets to page 1 when using Next or Previous.
• The documented bun run reset-password email command is now available. It generates a temporary password for a locked-out account and invalidates that user's sessions.

Security

• Avatar serving is confined to the requesting user's own directory. Encoded .., path separators, and NUL bytes in filenames are rejected to prevent path traversal.
• Report updates now use the validated request body, preventing clients from injecting the forwardedTo field through mass assignment.
• Invitation acceptance consumes tokens atomically, preventing concurrent acceptance or token reuse.
• sharp is upgraded to ^0.35.3 (libvips 8.18.3) to resolve GHSA-f88m-g3jw-g9cj, a high-severity image-processing advisory.

Maintenance

• Added xlsx for Excel share downloads.
• Shared download blobs now revoke their object URLs after the download completes.

How to Upgrade

Docker

docker compose pull && docker compose up -d

The report history migration runs automatically on startup.

Bun

git pull
bun install
bun run build
bun run start

The migration runs automatically on first launch.