Release v22.19.0

Summary

Three places where the quieter of two possible behaviours was also the less safe one, and where the C# implementation disagreed with the JVM one over the shared HTTP contract.

Added

• SortDirectionIsNotRecognized, the validation failure raised for an unrecognized sort direction (#2715)

Changed

• A query request reader that rejects input as invalid now surfaces as the documented malformedRequest validation failure rather than an exception envelope. Reader failures that are not validation failures are unchanged (#2715)
• The shared HTTP contract documents SSE connection ownership and the sort direction vocabulary as single behaviours, with the remaining narrower difference in what each implementation compares for ownership stated explicitly (#2713)

Fixed

• sortDirection=descending sorted ascending. asc, ascending, desc and descending are all accepted case-insensitively now, and any other value is rejected as malformedRequest with 400 instead of being answered in the opposite order to the one asked for (#2715)

Security

• SSE subscribe and unsubscribe now verify that the caller owns the connection they name. The identity that opened the stream is captured once and compared on each control request; a mismatch returns 404, exactly as an unknown connection id does, so the endpoints never confirm another caller's connection exists. Previously a caller holding another connection's id could attach a subscription whose results were written into that caller's stream, or cancel their subscriptions (#2713)