agorise/morphit
agorise/morphit
Watch
1
0
Fork
You've already forked morphit
 0
Code Issues Pull requests Projects Releases 186 Packages Wiki Activity Actions
186 releases 186 tags
  • v1.17.14 09c3949183

    Morphit v1.17.14
    All checks were successful
    morphit-ci / Supply-chain audit gate (fail on new high/critical) (push) Successful in 34s
    Details
    morphit-ci / TypeScript typecheck (sweep all workspaces) (push) Successful in 56s
    Details
    morphit-ci / apps/web svelte-check (svelte-kit sync + svelte-aware tsc) (push) Successful in 54s
    Details
    morphit-ci / Integration tests (real Postgres 16) (push) Successful in 1m59s
    Details
    morphit-ci / ansible-lint (playbook quality gate) (push) Successful in 59s
    Details
    morphit-ci / Smoke suite (run-smokes.sh, triple-pulse) (push) Successful in 35m12s
    Details
    morphit-release / Build + publish release tarball (push) Successful in 36m25s
    Details
    Stable

    agorise released this 2026-09-17 18:21:24 +00:00 | 1 commits to main since this release

    Signed by agorise
    GPG key ID: 53524E1F1017EB9C

    Morphit v1.17.14

    Three fixes to what an upgrade tells you and how long it interrupts your site.
    No protocol or consensus change.

    Fixed

    • Your site is restarted once per upgrade instead of twice. The web front end
      was rebuilt and restarted a second time moments after the first, every upgrade,
      even when nothing about it had changed — a short outage for no reason. The
      second pass exists for a real case (an older installer that does not rebuild),
      so it now asks the running site what settings it is actually using and does
      nothing when they already match.
    • The warrant-canary reminder now tells you the truth for your setup. It said
      the canary "republishes on its own at the next scheduled weekly refresh". That
      is only true on an instance that runs that refresh itself. If you sign your
      canary on another computer, nothing on the server republishes anything — and
      believing otherwise would let it go stale after 14 days and show your visitors
      a false tamper warning. The reminder now checks which setup you have and says
      what actually applies.
    • A privacy-only instance no longer gets two contradictory messages. One said
      a check was skipped because the instance is reached through Tor and I2P; the
      next told it to configure an ordinary web address it correctly does not have.

    Notes

    • No protocol/consensus change. Everything here is operator-facing.
    • If a recent upgrade warned that your privacy address was "advertised wrong",
      that came from the previous version doing the check. It settles once every
      instance is on this release.
    Downloads