learnhouse Files

✨ Features

• Merge pull request [#1149] from learnhouse/feat/content-embeddings (abc7b781)
• feat(ai): index all course content for AI search (47191d0d)

🐛 Bug Fixes

• Merge pull request [#1151] from learnhouse/fix/security-hardening-round6 (be0057e0)
• fix(api): only read caption tracks whose language code is a plain name (bde8b8de)
• fix(api): build single-tenant credential links from trusted origins only (e0ee5ba5)
• fix: address review findings in the hardening round (33ed0d29)
• fix(api): treat superadmin API tokens as superadmin in resource checks (174a8dc2)
• fix(api): resolve API token principals and enforce token rights (d343f311)
• fix: cap request bodies and unauthenticated collab connections (c525ea72)
• fix(web): verify subscription state before applying a billing plan (672b7282)
• fix(api): apply reader gates to folders, assignments, code runs and media (d8e3d399)
• fix(auth): harden email verification, email change, reset and sign-in flows (e2b24854)
• fix(api): tighten org admin actions and clean up access on member removal (6063287f)
• Merge pull request [#1146] from learnhouse/renovate/all-minor-patch (a35c73c5)
• fix(deps): update all non-major dependencies to v1.43.109 (0dc5073a)
• Merge pull request [#1142] from learnhouse/fix/access-control-2026-10-part3 (554688d4)
• fix: enforce admin API token rights, CSRF checks and export scope (3482e9f5)
• fix: harden auth flows, content access, privacy and resource limits (a2558c55)
• Merge pull request [#1141] from learnhouse/fix/deps-security-2026-10 (6b16c5c6)
• fix(deps): patch vulnerable Next.js, sharp and transitive packages (f600f385)
• Merge pull request [#1138] from learnhouse/fix/issues-1075-1131-1137 (bc5ca950)
• fix: task ordering, callout lists, markdown in AI editor replies (f3c646ac)
• Merge pull request [#1135] from learnhouse/renovate/stripe-23.x (a346e362)
• Merge pull request [#1134] from learnhouse/renovate/stripe-16.x (9e3346a2)
• Merge pull request [#1133] from learnhouse/renovate/motion-14.x (250c9d61)
• Merge pull request [#1132] from learnhouse/renovate/all-minor-patch (54996d68)
• fix(deps): update dependency stripe to v23 (e0bceebd)
• fix(deps): update dependency stripe to v16 (ef0d69e9)
• fix(deps): update dependency motion to v14 (c0119ae2)
• fix(deps): update all non-major dependencies (79eb08be)
• Merge pull request [#1128] from learnhouse/fix/access-control-2026-10-part2 (b608f735)
• Merge pull request [#1120] from learnhouse/fix/access-control-2026-10 (9a131918)
• Merge pull request [#1127] from learnhouse/fix/scorm-proxy-auth (682d8f8e)
• fix: scope roles to their org and harden admin, email and plan paths (a6590c7c)
• fix(web): run bun tests with --isolate (f96f4edb)
• fix: forward session auth in SCORM proxy (bef5783b)
• Merge pull request [#1123] from learnhouse/fix/sentry-sweep-followup (a9ae9a54)
• Merge pull request [#1124] from learnhouse/fix/payments-authz (fae647dc)
• fix: tighten access checks across orgs, content and accounts (0ce31fc3)
• fix(api): enforce read access on content-derived endpoints (7b8a3e22)
• Merge pull request [#1118] from learnhouse/fix/release-uv-lock (c8515a6f)
• fix: refresh uv.lock on release version bump (fbdd24b3)

⚡ Performance

• perf(web): cache resolved Intl locales (e83f9d8f)

♻️ Refactoring

• Merge pull request [#1145] from learnhouse/feat/web-ee-private (6b1dc612)
• refactor(web): import Enterprise modules via @ee alias (cca2eff8)
• refactor(api): tidy HLS cancellation handling (43b4ebbf)
• refactor(api): share activity read gating, tidy RAG access scope (63a92ea2)

📚 Documentation

• Merge pull request [#1121] from learnhouse/docs/humanize-text (6cc25959)
• docs: move CLI test-audit note edit to avoid PR overlap (95a65a1e)
• docs: fix awkward sentences and reword frontmatter descriptions (31ef7b4e)
• docs: tidy punctuation and wording (2e1b57f0)

🔧 Maintenance

• Merge pull request [#1150] from learnhouse/chore/docs-drop-vercel-analytics (4670a7df)
• chore(docs): remove Vercel Web Analytics (36a467c6)
• chore: drop duplicate superadmin import (a42e4bdd)
• Merge pull request [#1125] from learnhouse/chore/string-dashes (5d57f3b0)
• Merge pull request [#1122] from learnhouse/chore/comment-dashes (52e871d4)
• chore: replace remaining em dashes in onboarding, admin notices, and an error message (834630e6)
• chore: take over release script and test-audit note edits (47054344)
• chore: move release script comment edit to avoid PR overlap (94490a3e)
• chore: replace em dashes in user-facing and runtime strings (7dfb24dc)
• chore: smooth wording in rewritten comments (b014014b)
• chore: replace em dashes in comments and docstrings (9410fcd8)

👥 Contributors

@swve

📦 Getting Started

New installation:

:::bash
npx learnhouse setup

Upgrade to this version:

:::bash
# Back up your database first
npx learnhouse backup

# Update to this specific version
npx learnhouse update --version 1.4.0

Docker image:

:::bash
docker pull ghcr.io/learnhouse/app:1.4.0

Full Changelog: https://github.com/learnhouse/learnhouse/compare/1.3.7...1.4.0