No changes match these filters. Try a different search, impact, or backend.
This release adds JFrog Artifactory and AWS S3 as first-class extensions, introduces per-deployment resource configuration, hardens authentication security, and overhauls the documentation site.
— mint scoped, short-lived credentials for image push and Kubernetes pull secrets via JFrog’s access token API or a Vault plugin. Separate push/pull TTLs, per-project scope isolation, and pull credential caching included.
— automatically provisions a dedicated S3 bucket and scoped IAM credentials per project, injected as environment variables. Supports DeletionBlocked state when a bucket is non-empty, with opt-in force_empty_bucket for safe teardown.
— set replicas, cpu, and memory in rise.toml or via --replicas/--cpu/--memory CLI flags. Admins can set per-environment min/max constraints; values are validated at deployment time.
— user and engineering docs now live at docs/user and docs/engineering with improved structure and navigation.
rise backend rise-toml-schema CLI command— generates the rise-toml-v1.schema.json directly; the old /api/v1/schema/rise-toml/v1 endpoint now redirects (301) to /docs/schemas/rise-toml-v1.schema.json.
— cookies no longer carry a Domain attribute, preventing cross-subdomain leakage between the Rise API and app subdomains. Ingress auth flows now always redirect through /.rise/auth/complete on the app’s own domain.
aud claim— private-app JWTs previously used the Rise server URL as audience; they now use the app’s own URL. API middleware rejects RS256 ingress tokens, preventing them from authenticating API calls.
— replaced brittle string-matching on formatted error types with typed AWS SDK error variants across S3 and RDS extension providers.
cookie_domain setting repurposed— this field no longer sets the Domain attribute on new cookies. It is now used only to clear stale domain-scoped cookies during migration. Existing configs continue to work, but cross-subdomain cookie sharing via cookie_domain is no longer supported.
— the legacy_adopt_existing_resources_to_metacontroller backend setting and adoptExistingResources Helm value have been removed. Clusters that still rely on this one-time migration path must complete the migration before upgrading.
— credentials are now fetched from GET /projects/{name}/deployments/{id}/registry-credentials (scoped to Pending/Building/Pushing states) instead of the old project-scoped endpoint. Older CLI versions fall back to credentials in CreateDeploymentResponse, which is now deprecated.
Routine updates to tokio, openssl, aws-sdk-s3/s3-js, jsonwebtoken, tailwindcss 4.3, vite 8, react 19.2, pack 0.40.6, gunicorn 26, and several other crates and npm packages.