v0.12.1 security release: the voice channel now needs a secret token in its address, plus single sign-on and offline install, with the limits the notes admit

Short answer: ragleap-core v0.12.1 is a security release. Before it, the voice channel’s WebSocket server accepted every connection. If you expose the voice port, upgrade, put a long random VOICE_WS_TOKEN in .env and change the Twilio stream address to end in that token. This post follows the release notes; the fix was not separately tested for it.

What was wrong

The voice channel runs a WebSocket server, and the Twilio setup needs it reachable from the internet. Until v0.12.0 that server accepted every connection (advisory GHSA-fg9g-772q-rr9c on GitHub; updated 2026-11-09: this said “in the release notes”). The notes list v0.1.0 to v0.12.0 as affected, for installs that expose the voice port.

What v0.12.1 changes

A call is accepted only when the address it connects to ends in a secret: wss://your-domain.com:8765/<VOICE_WS_TOKEN>. A missing or wrong token gets a plain HTTP 401 and never becomes a call.
Limits: VOICE_MAX_CALLS (default 10), VOICE_MAX_CALL_MINUTES (default 30), and 64 KiB per message.
Spoken feedback (“good answer” or “bad answer”) is ignored on the voice channel, because callers are anonymous.
New installs get a token from the installer.

If you use the voice channel, do this after upgrading

Put a long random value in .env as VOICE_WS_TOKEN, for example from openssl rand -hex 24.
Change the Twilio <Connect><Stream> address to wss://your-domain.com:8765/<VOICE_WS_TOKEN> (use wss).
Rebuild and restart the voice service. If the token ever leaks, change it in .env and in the Twilio address.

Also in this release

Single sign-on with OpenID Connect, off by default: PKCE and strict ID token checks, an optional second-factor rule, identities, sessions, login routes and audit, a dashboard button, a Users tab and an admin guide (docs/single-sign-on.md).
A SHARED_KEY_DISABLED switch to refuse the shared API key once an owner has a personal key.
Link a person to a Telegram, WhatsApp or Discord chat, so channel approvals name them.
Request metrics at GET /metrics (off by default) and an X-Request-ID header, plus an HTTP throughput check in benchmarks/.
The Neo4j password now comes from NEO4J_PASSWORD in .env, with a warning for the public default.
Offline install: a bundle builder, install.sh --offline, and an offline and GPU guide with an optional NVIDIA compose override.

Upgrade notes

Back up first, then apply db/schema.sql (idempotent) to existing databases. It adds user_channels, user_identities, user_sessions and sso_logins.
Rebuild the app image. Single sign-on and metrics stay off until you set their settings.

Limits the release notes state

Single-tenant. Single sign-on was tested against a fake provider only, not Keycloak, Entra ID or Okta (updated 2026-11-09: the v0.13.0 release notes say it has since been tested on Keycloak for sign-in and refusals only, not on Entra ID or Okta).
The offline install has not been tried on an air-gapped machine, and the GPU override has not been tried on a real GPU.
Not independently security reviewed.

Full notes: ragleap-core v0.12.1 on GitHub. For what is built and what is planned, see the roadmap.

The same facts are on the Security page.