Skip to content

v3.1.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Aug 15:32
v3.1.0
f732f93

Commit Summary

Added

  • Add: Measure authentication latency by outcome (4be7a93)
  • Add: Measure gRPC response-boundary latency (1a49b0f)
  • Add: Close native plugin Lua parity gaps (e4e3cf6)
  • Add: Complete native plugin prerequisite contracts (3705e40)
  • Add: Support reusable policy string sets (0ae6a27)
  • Add: Support generic GeoIP privacy prefix feeds (98bda71)
  • Add: Measure complete post-action latency (6c5d932)
  • Add: Gate shared-egress brute-force with reputation (5a1f9b8)
  • Add: Emit free network privacy intelligence (14ee7da)
  • Add: Expose plugin backend identity results (8655e8a)
  • Add: Implement Nauthilus admin client for REST backchannel operations (255c7e7)
  • Add: Enrich GeoIP ASN organizations from MMDB (96b38c1)
  • Add: GeoIP reputation and ClickHouse enrichment (da19e1a)
  • Add: Native Go plugin runtime (93e154a)

Changed

  • Change: Make gRPC backend references opt-in (15c9a47)
  • Change: Optimize GeoIP request processing (430713f)
  • Change: Eliminate request policy snapshot clones (e85a414)
  • Change: Reduce authentication policy latency (c652183)
  • Change: Extend ClickHouse privacy dashboard (11bdb1d)
  • Change: Standardize plugin runtime exchange (72f4133)
  • Change: Complete native post-action parity (e02d1f4)
  • Change: Move module path to v3 (a76e254)
  • Change: Complete native Go plugin API follow-up (75c39e4)
  • Change: Extend ClickHouse GeoIP reputation analytics (a353043)
  • Change: Use local GeoIP ASN routing snapshots (9b036d9)

Fixed

  • Fix: Complete MFA self-service continuations safely (f732f93)
  • Fix: Restore MFA self-service recovery (8bad397)
  • Fix: Preserve WebAuthn authenticator capabilities (9a80805)
  • Fix: Preserve Go experiment during package discovery (b416740)
  • Fix: Align LDAP health probes with transport TLS (aefda56)
  • Fix: Prevent backend lookup response mutations (d5a7d9d)
  • Fix: Make authentication caches collision-safe (49da3e7)
  • Fix: Load declarative policy allowlists (828c586)
  • Fix: Map pre-auth policy failures to deny (c41fd6f)
  • Fix: Route plugin LDAP requests to worker pools (5384c3f)
  • Fix: Keep build targets source-safe (f22ff2e)
  • Fix: Add protocol-aware backend TLS upgrades (bf88a4b)
  • Fix: Separate brute-force learning obligations (845557a)
  • Fix: Make authentication trace ownership deterministic (3536b54)
  • Fix: Correct RWP allowance lifecycle (85c1c5f)
  • Fix: Keep native post-actions plugin-owned (04acd31)
  • Fix: Repair native ClickHouse analytics rows (139bda8)
  • Fix: Run native subject sources on memory cache hits (bf0fdde)
  • Fix: Respect policy check dependencies (7ba60d4)
  • Fix: Normalize Lua runtime snapshots for native plugins (7b2f5f2)
  • Fix: Allow native mail plugin capability (ecd1617)
  • Fix: Scope auth request contexts and plugin effects (d4adaf4)
  • Fix: Reduce password-history load overhead (3acfda6)
  • Fix: Honor Basic Auth for Lua custom hooks (4604b38)
  • Fix: Support native plugin policy producers (f968f0b)
  • Fix: Preserve localized MFA self-service step-up (d6492ed)
  • Fix: Use effective MFA policy for forced registration (8d33e39)
  • Fix: Separate MFA enrollment from step-up assurance (02a273d)
  • Fix: Persist MFA step-up session state (6f832db)
  • Fix: Preserve OIDC introspection token semantics (a9185cd)
  • Fix: Preserve OIDC reentry flow state (fcae409)
  • Fix: Resume IDP flow after WebAuthn MFA (89073e8)
  • Fix: skip GeoIP reputation for backend health checks (89b5b91)
  • Fix: Persist GeoIP reputation policy facts (ccf060d)
  • Fix: Close native Go plugin API gaps (3b689d6)
  • Fix: Execute native plugin environment checks (04efe1c)
  • Fix: Align debug plugin build tags (6721f57)

Removed

  • Remove: Eliminate password verification singleflight (0aab32b)

Refactored

  • Refactor: Share plugin runtime value cloning (ea6feb5)
  • Refactor: eliminate project-wide lint backlog (b5db02c)
  • Refactor: clear non-structural lint backlog (08afffa)

Tests

  • Test: Add Go fuzzing and state models (c8faa7b)

Documentation

  • Docs: Require development on features (434df94)
  • Docs: Record beta.50 Core API gate (8f8cf29)
  • Docs: Keep prerequisite report English-only (ec3a05f)
  • Docs: Record native plugin prerequisite handoff (887e3b6)
  • Docs: Correct ClickHouse login cache key (e0eadb1)
  • Docs: Clarify GeoIP ASN lookup timeout (a222960)

Build And CI

  • Build: Pin Go patch toolchain for CI and images (f569642)
  • Build: Keep signed plugin images verifier-compatible (0856c54)
  • Build: Sign bundled GeoIP plugin in stable images (8eafcb2)
  • Build: Normalize Docker manifest annotations (727f327)
  • Build: Use native Docker architecture runners (8621b7a)
  • Build: Enable GeoIP plugin in stable image (4f8732f)

Security

  • Security: Update grpc-go to 1.82.1 (7159522)
  • Security: Enforce configured OIDC PKCE (2171c37)
  • Security: Harden Codex Security boundary fixes (b344596)
  • Security: Remove stale config-load admin command (d7dca88)
  • Security: Fail closed hook async and client boundaries (ecc0706)
  • Security: Bound Lua SQL LDAP and ClickHouse inputs (4e588ac)
  • Security: Fix Codex Security boundary findings (67a833a)
  • Security: Enforce SAML federation controls (079881a)
  • Security: Enforce MFA assurance at sensitive boundaries (f796e80)
  • Security: Enforce OIDC client auth boundaries (a451cb8)
  • Security: Enforce OIDC token boundaries (1688848)
  • Security: Block sensitive auth and config output (d54dcec)
  • Security: Close Codex Security findings (72dfb2b)

Dependencies

  • Vendor: Refresh Go dependencies (9d3275c)

Full Changelog: v3.0.1...v3.1.0

Assets 12
Loading