Offset Assure 0.2.47

Offset Assure 0.2.47: Docker fix for evidence files

Important for Docker installs: before updating, open Backups and click "Take a backup now".

Fixed

• Docker: uploaded evidence files now survive updates. Before, the Docker version kept them inside the container, and each update removed them.
• Missing files come back on their own. When the product starts, it restores any missing evidence file from the newest backup that has it. Files uploaded after the last backup cannot be recovered, which is why we ask for a backup before updating.

Added

• Docker: you can now choose the folder where the product keeps its data. Add OFFSET_DATA_DIR=D:/OffsetData/assure to .env and the database, evidence, backups and logs go into that folder, where you can see and copy them.

Windows and Linux installs were not affected. No action is needed for them.

Offset Assure 0.2.46

This release fixes the issues found in our security audit of 24 October 2026. No critical or high-severity issues were found. We recommend updating.

Fixed

• Files with Arabic, Chinese, Hindi or emoji names can now be downloaded. Before, they uploaded but gave an error on download.
• A wrong sign-in now takes the same time whether or not the username exists, so it no longer hints which usernames are real.
• If someone types their password into the username box by mistake, it is no longer stored in the audit trail or the sign-in log.
• Linking a record to something that no longer exists now shows a clear message instead of "Something went wrong".

Hardened

• Updated components with published security fixes: zod 4, nodemailer, Fastify and fast-uri.
• Smaller, cleaner Docker images. npm and development tools are removed, and the base system is up to date. The app image now has no known vulnerabilities.
• Every build tool used to make a release is pinned to an exact version.
• The page can no longer ask for the camera, microphone or location.

Documentation

• SECURITY.md now describes exactly the security features the product has. Multi-factor sign-in and single sign-on are not yet available; multi-factor sign-in is planned for Q1 2027.

No action is needed after updating. Your data and settings are unchanged.

Offset Assure 0.2.45

fix: one "today" everywhere, in the organisation's time zone

Evidence collected today could show as "-1 days old" east of UTC (in India
between midnight and 05:30): parts of the product took today's date from UTC
and parts from the browser.

• The server works out every calendar date in its own zone (TZ for Docker),
  and SQL gets the same date through a today() function.
• Evidence age is never below nought, and stale means older than 90 days on
  the golden thread, the evidence list and the reports alike.
• Screens fill in today's date from the computer's own calendar.
• Report footers show local time and the zone, not UTC.
• Tests run at 02:00 in India, when UTC is still on the day before.

Offset Assure 0.2.44

Offset Assure 0.2.44