Skip to content

2.4.0-rc.18

Pre-release
Pre-release

Choose a tag to compare

View all tags
@lakhansamani lakhansamani released this 07 Aug 17:28
2.4.0-rc.18
935abac
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security-dependency release on top of 2.4.0-rc.17.

Dependency fix

cel-go bumped 0.28.1 → v0.29.2, clearing GHSA-gcjh-h69q-9w9g (CVSS 6.3, affects >=0.22.0,<=0.28.1). It reached us transitively through openfga.

The advisory: ext.NativeTypes(ParseStructTag("json")) does not honour JSON's skip directive, so a field tagged json:"-" becomes readable through a CEL expression as dyn(obj)["-"].

This was assessed as not exploitable in Authorizer before bumping. The vulnerable package is linked in (via buf.build/go/protovalidate/cel), but the vulnerable function is never called — not by protovalidate, not by OpenFGA, not by Authorizer itself. Exploitation also needs attacker-controlled CEL, and the only CEL inputs here are compiled-in buf.validate constraints and OpenFGA conditions that only a super-admin can author.

Upgrading is still recommended: the fix is a dependency version change with no behaviour impact.

Note for anyone scanning their own build: govulncheck does not flag this advisory — it is not in the Go vulnerability database yet. A clean govulncheck run is not evidence about GHSA-gcjh-h69q-9w9g either way.

Everything from rc.17 and rc.16 still applies

No new breaking changes in this release. If you are upgrading from rc.15 or earlier, read the rc.16 notes first — that release carried the full 22-finding pre-release security audit, including:

  • --enable-email-verification with no SMTP now fails at boot
  • social logins now require the provider to attest the email address (nOAuth defense) — action required for Microsoft/Entra
  • _delete_user / DeleteUser take id, not email
  • delegated FGA against a model with no type agent is denied
  • wildcard CORS no longer sends Allow-Credentials

rc.17 added the email-verification decision core and the empty-subject token rejection.

Note that rc.15 was tagged but its build was cancelled — no rc.15 image was ever published.

Matching SDK releases

SDK Version
authorizer-js 4.0.0-rc.0 (npm rc tag)
authorizer-react 2.2.0-rc.7 (npm rc tag)
authorizer-go v2.2.0-rc.5
authorizer-py 0.3.0rc4
authorizer-proto-go v0.2.0-rc.1
authorizer-proto 0.2.0rc1

Upgrading

Read the email verification contract before upgrading if you use Microsoft login.

Assets 2
Loading