Release Portal v0.44.0 — The v1 hardening pass · AndrewDryga/emisar

This release closes a full pre-1.0 security audit across the portal, runner, MCP bridge, packs, and the release chain itself.

Security

Patched the OIDC library for a HIGH-severity SSO authentication-bypass advisory (EEF-CVE-2026-75759).
Control and bidirectional characters are rejected at ingest, so they cannot reach an approval or audit surface.
The raw session cookie no longer reaches LiveView assigns, and a spoofable staff operator id no longer reaches a customer's audit trail.
Both installers fail closed on a tampered download checksum.

A dispatch that fails to decode, or carries the wrong wire-protocol version, is rejected at the wire and journaled; a protocol mismatch is now permanent rather than retried.
Each pack runs contained to its own tree, the runner's journal is protected from path-argument actions, and the runner refuses a credential file it does not own or that is reached through a symlink.
status is single-shot, an interrupted action has its whole process group killed, and SIGHUP reloads the full config.

find_actions pages on rank, so promoting a concept can no longer loop or skip results.
Several OAuth and MCP responses that reported the wrong thing to a client were corrected, and the device poll buckets per authorization so concurrent installs behind one address do not exhaust each other.
A TLS 1.2 floor is pinned on the bridge's HTTP client.

Most of the catalog was republished. Three actions were corrected to describe the change they make, and several reads that could answer with a false all-clear now report honestly.
Secret-bearing reads redact more at the source (Redis ACLs, pm2 environments, secret-named variants), and versions that printed credentials — including old minio releases — were retired across the fleet.
Privileged packs ship an exact host-access recipe, and every pack's curl runs with the user curlrc disabled.

Portal pages load faster and their cost is measurable; a paid plan's entitlements follow the subscription lifecycle, and Paddle runner quantities stay in sync.
A requester can withdraw a run that is still waiting for approval.
The one-time audit CSV export is bounded and no longer mis-signals a drained export.

Every runner and bridge binary is built by a trusted publisher workflow with signed checksum attestations and SLSA provenance you can verify before you install.
Every Docker image CI builds or ships is pinned.

Runner v0.24.0 and MCP Bridge v0.11.0 ship with this release.