Skip to content
Plugwerk

Plugwerk 1.1.0

Released: 2026-07-20 · GitHub release · Docker image

1.1.0 is a stable minor release. It adds an opt-out, privacy-respecting telemetry beacon, fixes branding-asset cache invalidation, makes the API more tolerant of explicit null values, and refreshes the runtime and dependency stack (Spring Boot 4.1.0, Kotlin 2.4.0, closed Tomcat CVEs). There are no breaking changes.

Highlights

Section titled “Highlights”
  • Opt-out telemetry beacon — the server now sends a small, zero-PII beacon (a synthetic install ID, the version, the deployment type, and a server_start/heartbeat event) once on first start and once daily, so the maintainers can size the install base and prioritise work. No hostnames, IPs, namespaces, usernames, or plugin data are ever collected; data is processed on PostHog EU Cloud under a signed DPA. It is opt-out — disable it entirely with PLUGWERK_TELEMETRY=false. Full detail, the four-field payload, the GDPR basis, and every related variable are documented on the new Telemetry & Privacy page.
  • Branding assets invalidate correctly on change — replacing or removing an operator-uploaded logo or favicon in the admin UI now takes effect immediately. Previously an over-aggressive immutable Cache-Control header could keep serving the old asset from browser and CDN caches.
  • More tolerant API null handling — the REST API now accepts an explicit null on nullable model fields instead of rejecting the request. Clients that serialise optional fields as null (rather than omitting them) no longer need special-casing.
  • Security & runtime refresh — upgraded to Spring Boot 4.1.0 and Kotlin 2.4.0, and closed a set of Tomcat CVEs. This release also folds in an extensive round of dependency updates across the backend and frontend.

Breaking changes

Section titled “Breaking changes”
  • None. 1.1.0 is a drop-in upgrade from 1.0.0.

Upgrade notes

Section titled “Upgrade notes”

  1. Pull the new image:

    Terminal window
    docker pull plugwerk/plugwerk-server:1.1.0

    :latest now points at this stable release as well.

  2. Decide on telemetry (new, on by default). The opt-out telemetry beacon is enabled out of the box. It is zero-PII and cannot affect startup, health, or readiness (it is fail-open with short timeouts). If your policy requires sending nothing, set it before restarting:

    Terminal window
    export PLUGWERK_TELEMETRY=false

    See Telemetry & Privacy for exactly what is sent and the full list of related variables.

  3. No configuration or schema migration is required. Existing environment variables, storage backends, and OIDC providers continue to work unchanged.

  4. Verify the upgrade:

    • curl http://<your-host>/actuator/health returns {"status":"UP"}.
    • Existing logins and OIDC providers continue to authenticate.
    • If you rely on operator branding, confirm a re-uploaded logo/favicon now updates without a hard refresh.

Other notable changes

Section titled “Other notable changes”
  • .env.example is dispatched to this site on every release — the full environment-variable reference now includes the new PLUGWERK_TELEMETRY* and PLUGWERK_INSTALL_TYPE variables.
  • Broad Renovate dependency updates across the AWS SDK v2, Jackson, Kotlin, JUnit, Liquibase, PostgreSQL driver, and GitHub Actions, consolidated through the cycle.

Full changelog

Section titled “Full changelog”

See the GitHub release notes for the complete commit-level changelog and individual PR links.