Skip to content

0.35.0

Jump to bottom
Hussein Jarrar edited this page Sep 12, 2026 · 2 revisions

v0.35.0

5 changes · 2 Bugfixes, 3 New Features · 52 points.

Bugfix

  • RADD-1122 Six authorization defects found while tracing the directory readers (share expiry/deny, wiki batch policy, template scope, field scope transition, attachment grants)
    What was wrong. Replacing full-catalog reads with bounded windows (RADD-1115) meant reading every authorization path those catalogs sat behind, and six of them were wrong. None was in the original audit's twelve.
    access attachments dashboards fields pages views · 5 pts · 0402db2e
  • RADD-1121 September audit: the twelve prioritized defects (credential scope, merge authz, account cache, login throttle, live cache, mobile shell, realtime, overlays, lazy routes, PR checks)
    What was wrong. The 9 September repository audit (research/audit-2026-09-09/README.md) found twelve defects it ranked ahead of everything else. Four were trust-boundary bugs: an API key could mint an unscoped child token (POST /tokens never intersected the caller's scope) and a narrowly scoped admin PAT passed the…
    auth ci items realtime web · 13 pts · e2405698

New Feature

  • RADD-1115 Bound directory and query work and measure interactive scaling
    The initial September research identified these outstanding outcomes, and the user explicitly requested full completion. Ledger: research/audit-2026-09-09/OUTSTANDING.md, rows P2,P3,P4,P5,P6.
    13 pts · 9e54fa62
  • RADD-1120 Prove pinned-image adoption, upgrades and complete data portability
    The initial September research identified these outstanding outcomes, and the user explicitly requested full completion. Ledger: research/audit-2026-09-09/OUTSTANDING.md, rows C1,O1,O2,V2.
    13 pts · 584a00e1
  • RADD-1113 Paginate long discussions without leaking hidden comments
    The issue and wiki discussion clients fetch and render the entire comment history. The backend filters internal/team visibility after loading all rows, so long mail-driven threads have unbounded memory and rendering cost. The current list service also bypasses the registered per-parent read guard.
    comments performance · 8 pts · c15cb6ae

Changes from v0.34.0 to v0.35.0.

Pages

Mirrored from project.radd-hq.com on 2026-09-12. Documentation is written there; this copy is regenerated by scripts/publish_wiki.py and hand edits do not survive it.

Radd Documentation

Clone this wiki locally