Skip to content

v26.1.7

Pre-release
Pre-release

Choose a tag to compare

View all tags
@baramundi-bwiedemann baramundi-bwiedemann released this 14 Jul 16:16
v26.1.7
24d61f3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Version bumped 26.1.5 → 26.1.7 across the suite (26.1.6 was documented but
never tagged/released).

Removed (breaking)

  • Gateway token-map authentication (MCP_AUTH_CONFIG). The gateway no longer
    authenticates callers or maps Bearer tokens to bConnect credentials. Per ADR-0003,
    authentication is the operator's responsibility — front the gateway with an
    authenticating, TLS-terminating reverse proxy / IdP — and the gateway uses a single
    BCONNECT_* service credential (bMS RBAC governs it). Removed MCP_AUTH_CONFIG,
    the token map, hashed-token mode, and the hash-token helper.

Changed

  • Gateway fail-closed default: a non-loopback bind now requires MCP_ALLOW_NO_AUTH=true
    (asserting an authenticating proxy is in front). Loopback bind is otherwise unchanged.
  • Inbound rate limiting is now keyed per client IP (was per Bearer token).
  • docker-compose.gateway.yml publishes the host port on loopback only by default.
  • README / docs/DOCKER.md / docs/INSTALLATION.md / docs/N8N.md updated to the
    proxy-fronted, service-credential model, with a prominent operator-security notice.
  • Node.js baseline raised to 22 (LTS). Docker images now build on node:22-alpine
    and engines.node is >=20.0.0 (18 is EOL). The automatic OS-trust-store behavior
    below requires Node ≥ 22.15.

Fixed

  • TLS: honor the OS/client CA trust store (issue #59). Node validates TLS against
    its bundled CA list only and never reads the OS certificate store, so an internally
    signed bMS certificate that Windows already trusts still failed until the admin
    manually exported it and set BCONNECT_CA_CERT_PATH. On Node.js ≥ 22.15 the
    shared client now merges the OS trust store (tls.getCACertificates("system")) with
    Node's bundle, so an already-trusted CA works with zero export. BCONNECT_CA_CERT_PATH
    remains an explicit override; behavior is unchanged on older Node (feature-detected).
  • Clearer TLS errors. A certificate-not-trusted failure now returns an actionable
    message (upgrade Node, set BCONNECT_CA_CERT_PATH, or NODE_EXTRA_CA_CERTS) instead
    of a generic "cannot connect".
Assets 4
Loading