Ricardo went on an absolute tear fixing a ton of small and super valuable things. This release strengthens security boundaries, token encodings, JWTs, OAuth cleanup and much more.
Huge thanks to @ricardoofnl for speedy and quality work this weekend!
What's Changed
- fix: block reserved and tunnelled address ranges in httpsafe by @ricardoofnl in #798
- fix: stop issuing client-side cached reads with a zero TTL in RedisCache by @ricardoofnl in #799
- fix: never return a nil session with a nil error from the cached token repository by @ricardoofnl in #800
- fix: evict the session cache after revoking, not only before by @ricardoofnl in #801
- fix: bound the size of assets copied from scraped links by @ricardoofnl in #803
- fix: namespace session cache keys instead of using the bare token by @ricardoofnl in #802
- fix: record the bytes actually stored as the asset size by @ricardoofnl in #804
- fix: cap OAuth token permissions to the roles the account still holds by @ricardoofnl in #805
- ci: trigger test workflows on pull_request, not just push by @Southclaws with @Copilot in #806
- Normalize account handles to lowercase by @Southclaws in #772
- fix: issue session tokens from crypto/rand and store only their hash by @ricardoofnl in #809
- fix: prune expired OAuth refresh tokens instead of keeping them forever by @ricardoofnl in #814
- fix: expire email verification codes and stop brute force guessing by @ricardoofnl in #808
- fix(deps): update dependency next to v16.2.11 [security] by @renovate[bot] in #812
- fix: bind endec tokens to a purpose so they cannot be replayed across features by @ricardoofnl in #807
Full Changelog: v1.26.14...v1.26.15
Contributors
Southclaws, renovate, and ricardoofnl