Skip to content

vendor 1.6.0

Latest
Latest

Choose a tag to compare

View all tags
@AirLoren AirLoren released this 07 Nov 16:25
· 6 commits to main since this release
v1.6.0
1d3eb46

Added

  • API errors carry status, reason and the version-conflict marker; shared handlers for a refused project save or change (shared)
  • Resolve the caller's role in a sibling module from Pilot (auth)
  • Add require_edit_role for routes that create business objects (auth)

Fixed

  • An answer without a reason (empty body, proxy error page) says so instead of showing raw HTML (shared)
  • A 400 is a refusal too, a 404 of a targeted change says its reason, a validation error is said field by field (shared)
  • Keep an unfinished account deletion pending and retryable
  • Bump Mako to 1.4.3 and setuptools to 84.1.0 (deps)
  • Keep the directory source setting out of the dispatcher (frontend)
  • Confirm a change of the directory source (frontend)
  • Declare the finding view's default triage handler (frontend)
  • Accept completed legacy assessments from V1 exports, without a score
  • Keep unchanged and read-only roles when clamping to Pilot, and re-ask for a newer token (auth)
  • Restrict form targets to the origin in every module CSP (security)
  • Declare each module's event handlers (frontend)
  • Dispatch delegated events only to declared handlers (frontend)
  • Serve the API docs only when ENABLE_API_DOCS is set (suite)
  • Keep legacy assessments out of the workflow shortcut and drop their client score
  • Check the OIDC id_token issuer against OIDC_ISSUER when discovery omits it (auth)
  • Apply ALLOWED_EMAIL_DOMAINS and list only approved accounts in the directory
  • Lower module sessions to the roles Pilot currently grants (auth)
  • Refuse project creation, import and duplication to read-only roles (projects)
  • Authlib 1.9.1, pyasn1 0.6.5, dnspython 2.9.0 and joserfc 1.7.6 (deps)
  • Pin certifi 2026.10.19 as a transitive in every module (deps)
  • Certifi 2026.10.19, dropping the compromised emSign roots (deps)

Changed

  • Share the #rrggbb check of a colour read from data (frontend)

Documentation

  • A Watch scope owner is no longer a NOT NULL FK (shared)
  • Record trivy cooldown exception, Vendor rule 9 covers legacy completed imports
  • State the rules legacy assessments still follow
Assets 2
Loading