LoginSign Up
← Back to all sparks
W

Wakapi

PM
Velocity2.5

Self-hosted coding statistics and time tracking service

wakapi.dev ↗

A critical auth bypass lands in the middle of Wakapi's slow identity rebuild.

time-trackingself-hostedoidcauth-bypasscontainer-hardeningthin-release-notes
◆Current state
Wakapi's recent releases cluster around identity and deployment rather than time tracking itself: OpenID Connect login, then an OIDC-only mode, multiple API keys per user, and a switch from Alpine to a distroless nonroot container image. The 2.17.x line has carried two security fixes now — a responsibly disclosed issue in 2.17.3, and a critical authentication bypass in 2.17.6 caused by a shared cache key namespace. Release notes are mostly bare issue numbers, so several entries state that something changed without saying what.
◆Where it's heading
The direction is a self-hosted tool making itself deployable somewhere other than one developer's server. External identity providers, an option to disable local login entirely, per-key credentials and a container that runs as a nonroot user are the requirements that come from someone else's security review. The 2.17.6 bypass sits awkwardly against that: a cache keyed without proper namespacing is exactly the class of bug that multi-tenant deployment surfaces, which suggests the auth work is now being exercised harder than the code was written for. Releases have also thinned to roughly one a month from a much faster earlier cadence.
◆Prediction
The identity and packaging thread is the only sustained one in this feed, so further hardening in that area is the most likely continuation; the sparse release notes make anything more specific guesswork.

◆Recent moves

  1. 28d ago

    Critical auth bypass from a shared cache key namespace

    A single-line security release fixing a critical authentication bypass caused by a shared cache key namespace. It lands directly on the identity work this project has been building out, and the note gives operators no detail beyond the severity label and the cause.

    View source ↗
  2. 2mo ago

    Release 2.17.5

    Four contributor improvements listed as issue numbers with no descriptions, so the release's actual content is not readable from the notes. Consistent with how this project has been publishing recently.

    View source ↗
  3. 3mo ago

    Release 2.17.4

    One improvement and one bug fix, both identified only by issue number. Nothing in the entry indicates whether either affects users.

    View source ↗
  4. 5mo ago

    Security fix, relay endpoint dropped, summaries may need regenerating

    Carries a responsibly disclosed security fix, drops the relay endpoint, and clears several bugs. The note also warns that a custom language mapping bug may require regenerating summaries — an action item buried under a list of issue numbers.

    View source ↗
  5. 6mo ago

    Distroless nonroot container image; SQLite permissions need fixing

    Switches the Docker base image from Alpine to distroless nonroot, so Wakapi now runs as UID 65532 inside the container — a hardening change that requires SQLite users to fix data directory permissions before upgrading. It also fixes broken user registration.

    View source ↗
  6. 7mo ago

    OIDC-only login mode disables local accounts

    Adds an OIDC-only login mode, letting operators disable local accounts entirely once an external identity provider is configured. It is the natural second step after OIDC support landed in 2.16.0, and the one that makes central account control real.

    View source ↗