Skip to content

Release v2.22.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 18:31
v2.22.0
68720d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

  • Model matching-tenant invitation completion with the explicit InvitationCompletionDestination enum (ReturnUrl / Lobby).
  • Add Invite.MatchingTenantInvitationDestination and the Aspire WithMatchingTenantInvitationDestination(...) helper.
  • Keep ReturnUrl as the compatibility default, preserving the released matching-tenant behavior.
  • Compare the validated invitation tenant claim with the resolved request tenant; equality is routing evidence, not issuer identity.

Cratis Studio is unchanged: the invitation staging and exchange APIs and payloads are not modified.

Security boundary

This is a redirect-only setting. It changes only the destination after successful completion; invitation validation, staging, exchange, recipient binding, attestations, transaction consumption, cookies, and sessions remain unchanged. Matching tenant values do not prove which tenant issued the invitation.

Verification

  • AuthProxy specs: 2036 passed.
  • Aspire specs: 74 passed.
  • Focused current/callback/replay matrix:
Flow ReturnUrl Lobby
Current/post-login completion Continues toward the challenge return URL Selects the configured Lobby frontend
Provider callback completion Preserves the challenge return URL Redirects to Lobby after the same successful exchange
Stale-cookie replay Does not exchange again or redirect to Lobby; clears the cookie Does not exchange again; redirects to Lobby with the invitation ID and clears the cookie
  • Mutation check: 2/2 mutations killed.
  • Documentation limitation: the shared Documentation/web full check is unavailable because isolated runs timed out on unrelated Chronicle client generation; the source documentation stale-terminology scan and diff check passed.

Release note

Added

  • Configure matching-tenant invitations to complete at the challenge ReturnUrl or continue to Lobby. (#109)

Security

  • Resolve nanoid to ^3.3.18, fixing GHSA-2v37-7h3g-55p8 (HIGH).
  • Pin security workflow actions to verified full SHAs with persist-credentials: false.
  • Add a frontend dependency audit job blocking HIGH/CRITICAL advisories.

Verification audit

  • Code review: APPROVE
  • Security review: APPROVE
  • Evidence SHA-256: c3d8b25ea41a9362c942bdc7491ac6692dca21b7dba0219bab2e641eb678c4c2
Assets 2
Loading