Skip to main content

Uni-Verein 1.10.1 – First-Time Setup, New Device Notice and Preparation for Tenants 🛡️

· 5 min read
René Herrmann
René Herrmann
Senior developer

Published on November 3, 2026

Uni-Verein 1.10.1 gets rid of the well-known default password: a new installation creates the first administrator through a protected first-time setup. Uni-Verein also sends an e-mail on a login from a new device now. Under the hood the update prepares the database for multiple tenants and brings almost all dependencies up to date.

Highlights​

  • 🔑 First-time setup (UV-72): No more user Admin with admin123, the first administrator is created on first access with a setup token
  • 📧 New device notice (UV-69): An e-mail informs when someone logs in on an unknown device
  • 🏢 Preparation for tenants (UV-71): All data now belongs to a default tenant, a single installation behaves as before
  • ⬆️ Dependencies: ASP.NET Core 10.0.14, React 19, MUI 9, Vite 8 and more

New Features​

  • 🔑 First-time setup (UV-72): A fresh installation has no user. On first access the frontend shows the first-time setup page (GET /setup/status, POST /setup) where the first administrator is created with user name, email address and password (10 to 50 characters). The request needs the SETUP_TOKEN from the .env, which docker-compose-ini.yml generates and passes on to the backend as Setup__Token. Without a token the setup is locked, so nobody can take over a freshly started server. Both endpoints have their own rate limit (RateLimiting__Setup__PermitLimit, RateLimiting__SetupStatus__PermitLimit), POST /setup answers 409 as soon as any user exists, even a deleted one
  • 📧 New device notice (UV-69): When someone logs in with a browser that does not have the long-lived cookie uv_device yet, the user gets an e-mail with browser, operating system, IP address and time (in German and English). Only the hash of the cookie is stored, in the new table UserDevices. With two-factor authentication the mail is sent right after the correct password. Nothing is sent for a user's first device, for users without an email address or without stored mail settings, and at most one mail per user every 15 minutes. IP address and browser identification are neither stored nor logged, there is no location lookup

Changes​

  • 👤 No default administrator any more (UV-72): The user Admin with the password admin123 is no longer created. Existing installations keep their users and are no longer forced to change the password, a default password that is still set has to be changed by you under "Profile settings". The demo mode keeps its generated users
  • 🏢 Preparation for multiple tenants (UV-71): A new table Tenants with a fixed default tenant, every table except FirmwareVersions and FirmwareVersionNotifications gets a column tenant_id. The migration assigns all existing data to the default tenant, older backups can still be restored. Queries are filtered by the current tenant, new rows are stamped with it, booking numbers and payment acknowledgements are unique per tenant, background jobs run once per tenant and the login token carries a tenant_id claim (tokens without it stay valid). For now the tenant is always the default tenant, resolving and managing tenants is not part of this change
  • 🗄️ Entity Framework Core 10 and Npgsql 10 (UV-71): Needed for named query filters
  • ⬆️ Dependencies: Backend and frontend were updated, among others ASP.NET Core / EF Core 10.0.14, MailKit 4.18.2, Markdig 1.5.1, React 19, MUI 9, MUI X 9, Vite 8, vite-plugin-pwa 2, pdfjs-dist 6, tesseract.js 7, uuid 14 and TipTap 3.32.2. The vendored workers in frontend/public/pdfjs and frontend/public/tesseract were replaced and must always match the library version. CsvHelper 33.1.0, @fullcalendar/* 6.1.22 and typescript 6.0.3 were deliberately not updated
  • 🧰 Database migrator removed (UV-71): UniVerein.DbMigrator (the MariaDB to PostgreSQL copier) was removed, because the MySQL driver has no release for Entity Framework Core 10. The image ghcr.io/uni-verein/univerein-db-migrator:1.4.0 stays available, new versions are not published. The update path from MariaDB (v1.3.1 and earlier) moved to legacy-update/ with its own docker-compose-update.yml and README. The docker-compose-update.yml in the root only knows PostgreSQL and points to legacy-update/README.md when the compose file still uses MariaDB

⚠️ Update Notes​

  • Always update with docker-compose-update.yml, as described in the README
  • Check for a default password: There is no forced password change any more. If an account still has the password admin123, change it under "Profile settings"
  • New installations need the setup token (SETUP_TOKEN in the .env), see First-time setup. The .env.example file and docker-compose-ini.yml know the variable
  • API clients and tests that logged in as Admin with admin123 have to create the administrator through POST /setup. The E2E tests use TEST_SETUP_TOKEN, TEST_ADMIN_PASS and TEST_ADMIN_EMAIL for that
  • From MariaDB (v1.3.1 and earlier) you update through the legacy-update/ folder

Why These Updates Matter​

A well-known default password is a risk for every newly installed instance until someone changes it. With the protected first-time setup that window no longer exists. The new device notice makes stolen passwords visible before damage is done, and the preparation for tenants lays the foundation for future features without changing anything for existing installations.

What's Next?​

Further feedback from practice is as always very welcome, feel free to use GitHub Issues. Keep checking back here!