Skip to content

79.9.0

Choose a tag to compare

@cf-identity cf-identity released this 16 Oct 19:43
76e4b1d

What's Changed

🛡️ Security Updates

  • Fixes CVE-2026-59396

🛠️ Stability & Fixes

  • Fix DB Query Leak when passing too long Values to Users Endpoint by @adrianhoelzl-sap in #4077
  • fix oom error if we're caching too much data - follow-up on #4095 by @strehle in #4108
  • fix oom error if we're caching too much data. by @fhanik in #4095
  • Fix zone-path session attribute name overflow for long subdomains by @duanemay in #4093
  • Treat empty LDAP externalGroupsWhitelist as allow-all by @duanemay in #4089
  • granted scopes refresh token by @fhanik in #4107
  • Extend machine-to-machine audience exemption to externally-issued tokens by @duanemay in #4094
  • fix: prevent session creation on token requests by @mikeroda in #4084

📦 Maintenance & Internal

  • Pin the version and explicitly grant permissions to the PR size labeler by @duanemay in #4090
  • fix: use pull_request_target so the size labeler works on fork PRs by @duanemay in #4096

⬆️ Dependency Bumps

  • Upgrade Tomcat to version 11.0.27 by @strehle in #4104
  • build(deps): bump gradle-wrapper from 9.7.1 to 9.8.0 by @dependabot[bot] in #4087
  • build(deps): bump github/codeql-action from 4.38.1 to 4.38.2 by @dependabot[bot] in #4088
  • build(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /uaa by @dependabot[bot] in #4091
  • build(deps): bump org.apache.directory.api:api-ldap-model from 2.1.8 to 2.1.9 by @dependabot[bot] in #4092
  • build(deps): bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre in the guava group by @dependabot[bot] in #4099
  • build(deps): bump the selenium group with 3 updates by @dependabot[bot] in #4098
  • build(deps): bump codelytv/pr-size-labeler from 1.11.1 to 1.12.0 by @dependabot[bot] in #4097
  • build(deps): bump gradle-wrapper from 9.8.0 to 9.8.1 by @dependabot[bot] in #4102
  • build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @dependabot[bot] in #4103
  • build(deps): bump the selenium group with 3 updates by @dependabot[bot] in #4101
  • build(deps): bump org.barfuin.gradle.jacocolog from 4.0.2 to 4.0.3 by @dependabot[bot] in #4106

Full Changelog: v79.8.0...v79.9.0