Skip to content

Release v1.20.6

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 18:00
· 10 commits to main since this release
v1.20.6
eace5ce

RoboSystems Service v1.20.6

Summary

This maintenance release tightens SSO security by binding cross-app handoffs to the originating browser and corrects consolidation accounting so subsidiary sales post to the proper gain concept. It also adds label pinning for all ledger posting concepts to guard against taxonomy drift.

Security Improvements

  • Browser-bound SSO handoffs (#1946): Cross-app SSO completions now only succeed when the request originates from the same browser that initiated the handoff. This closes a window where a handoff token observed elsewhere could be redeemed from an unrelated client context.
  • OIDC and SSO auth models updated to carry and validate the browser binding through the full handoff lifecycle.

Bug Fixes

  • Deconsolidation gain concept (#1948): Sale of a subsidiary is now booked against the stock-in-subsidiary gain concept rather than the PP&E disposal gain. Prior periods recorded under the old concept will need review — see below.
  • Posting concept labels are now explicitly pinned across the RS-GAAP calculations, presentation, and rollup-rules taxonomies, preventing silent label changes from altering ledger output.

Technical Changes

  • New migration 0066_subsidiary_sale_gain_row adds the subsidiary sale gain row to the extensions schema.
  • Consolidation chart-template mappings (consolidation/v1/mappings/rs-gaap.jsonld) and tenant-exclude list updated to reflect the corrected concept.
  • Operator registration now logs at debug instead of info (#1947), significantly reducing startup log noise.
  • New test suite tests/taxonomy/test_posting_concept_labels.py enforces label stability for every concept the ledger posts to.
  • Documentation refreshed: Group-Consolidation.md and RoboLedger-Operations.md.

⚠️ Breaking Changes

  • Deconsolidation gain reclassification: Subsidiary sales previously posted to the PP&E gain concept now post to the stock-in-subsidiary gain concept. Reports, dashboards, or downstream integrations that filter on the old concept for deconsolidation events must be updated. Historical entries are not retroactively reclassified by migration 0066.
  • SSO handoff behavior: Clients that complete a cross-app handoff from a different browser/session than the one that started it will now be rejected. Integrations relying on out-of-band handoff completion must be revised.

📊 Release Statistics

  • Commits: 8
  • Files Changed: 24
  • Lines Added: 523
  • Lines Deleted: 53
  • Previous Release: v1.20.5

🔗 Links

🤖 Generated with Claude Code

Assets 2
Loading