v0.25.5
Released: 2026-04-26 · Channel: stable · Breaking: no
Summary
Three small admin-Updates / SSO improvements bundled together. All surfaced from real operator and customer use of the apply pipeline this week.
Added
“Test connection” button in the Updates tab (CHAT-106)
Round-trips a signed request to the chatalot-updater sidecar and reports pass/fail with latency. Same auth path as Apply, so a green result means Apply will work too. Click before you click Apply, or right after install — catches install-time misconfigs (env passthrough, secret mounts, network) before they bite an actual apply under the disruption window. Suggested by the customer who hit CHAT-105 (env passthrough) on first apply earlier this week.
In-flight apply state restoration (CHAT-113)
Previously, navigating away from the Updates tab and back lost the apply progress panel. The admin saw the Apply button enabled again as if nothing was happening, even though the pipeline was running in the background.
The Updates tab now queries the updater on every mount for the most recent apply. If it’s non-terminal, the progress panel re-attaches and polling resumes. Combined with the humanized progress states from v0.25.3 and the prominent success banner from v0.25.2, the apply UX now survives all the typical browser interaction patterns: idle nav, mid-apply page refresh, secondary tab open, etc.
OIDC: auto-promote user matching ADMIN_USERNAME on first login (CHAT-115)
For SSO-only deployments where the operator may never have had a
local chatalot account: the OIDC register path now grants admin to
the first OIDC user whose username claim matches the
configured ADMIN_USERNAME env var. Mirrors the local
first-user bootstrap and the existing env-var seed in main.rs.
Removes the dual-account dance an operator otherwise has to do: sign in via SSO, find that the new account isn’t admin, fall back to a local admin account, promote the SSO account via the admin UI, then go back to SSO. Now the operator just signs in.
Upgrade path
Click Apply in the admin Updates tab. Pure server + frontend changes; chatalot-updater image unchanged.
Release artifacts
Container image pushed to
registry.seglamater.app/seglamater/chatalot, cosign-signed
against the published public key.