v9.0.0

9.0.0 (2026-09-06)

⚠ BREAKING CHANGES

• cli: the --adminuser and --adminpasswd CLI flags and the SIPI_ADMINUSER / SIPI_ADMINPASSWD environment variables are removed. They configured nothing; deployments passing them must drop them.
• throttling: generic deployments that relied on the basic default now enforce the advanced tier and may answer 503/413 where they previously admitted large requests. Set SIPI_ADMISSION_MODE=basic to restore the prior shadow-only behavior.

Features

• scripting: Add a constant-time compare binding for credential checks (8ca249e)
• throttling: Default admission_mode to advanced (dde8070)

Bug Fixes

• cache: Clamp cache_used_bytes subtractions against underflow (aeb8b8b)
• cache: Harden the cache index format and reads against forgery (413cacc)
• ffi: Bound wedged JP2 decodes with a seam deadline (DEV-7080) (13c4d0e)
• ffi: Cap restricted views by sampling factor across regions (6782442)
• ffi: Charge the memory budget for Lua SipiImage.new decodes (1c85ddf)
• ffi: Length-cap the Range header before the regex (c3c5ef1)
• ffi: Let Lua SipiImage.new decode without an installed engine context (f3e41ed)
• ffi: Redact paths and drop the request-uri tag from error events (2b502ad)
• ffi: Refuse restrict decisions that do not restrict (7f9785b)
• ffi: Reset the connection when an encode fails after the head is sent (1dbcec5)
• format_handlers: Bound JPEG marker lengths and fix IPTC APP13 length (29f7798)
• format_handlers: Correct TIFF planar-separate ROI destination offsets (3f638c9)
• format_handlers: Guard trusted dimensions and empty ICC in codec paths (49d2313)
• format_handlers: Read each plane of a tiled planar-separate TIFF (ef3b46d)
• format_handlers: Reject TIFF scanlines smaller than the decoded line (db96c4d)
• format_handlers: Size JP2 stripe_heights to the component count (66f6c2c)
• format_handlers: Validate JP2 metadata box lengths and reads (1ddfd95)
• iiifparser: Bound rotation, region, and size-pct against out-of-range input (6751d58)
• image_processing: Avoid divide-by-zero in subtract on identical inputs (74e00fd)
• image_processing: Guard convertYCC2RGB channel count and 16-bit midpoint (07c6dc2)
• metadata: Compute base64 decode length without integer underflow (8492b89)
• scripting: Default response cookies to HttpOnly and SameSite=Lax (3a9e282)
• scripting: Delete the token.lua postMessage relay and its route (594e760)
• scripting: Harden Lua print, mkdir mode, and json depth (f3a0e21)
• scripting: Require a token and a uuid62 basename for the upload example (7b92dbb)
• server: Admit docroot static serving and cache the libmagic database (1f79fa5)
• server: Answer 404 for image-path traversal and docroot dotfiles (553f2cf)
• server: Answer 408 when a request handler exceeds its timeout (255a288)
• server: Bound Lua-route request bodies by size and time before admission (b6b0984)
• server: Gate bare-restrict info.json and knora.json behind a denial (996a0f1)
• server: Refuse startup on an unsafe jwt_secret and drop the shipped default (92d54c7)
• server: Refuse startup when docroot overlaps a writable or script root (348ec28)
• server: Stop info.json and knora.json leaking restricted dimensions (7f9adda)
• server: Structurally enforce the query-free preflight cache key (3a19452)
• server: Validate the forwarded host against a SIPI_PUBLIC_HOSTS allowlist (1baaa1a)

Code Refactoring

• cli: Remove the dead adminuser and adminpasswd surface (b3afa68)
• ffi: Drop the unused client_ip field from the serve seam (4648cf0)
• ffi: Route both decode paths through one guarded helper (1c46c1c)

Documentation

• adr: Add ADR-0026 and the engine-seam extraction plan (62fbc04)
• adr: Record the per-client fairness ruling in ADR-0022 (48f60ef)
• adr: Scrub stale paths and fix status metadata in active ADRs (a088db2)
• cli: Reconcile config, CLI help, and domain docs with wave-2 behavior (94267f4)
• docs: Refresh ARCH-MAP entries after the wave-2 branch (460deb0)
• learnings: A supervised subagent must return at a long build, not park on it (409c92b)
• learnings: A timeout/slowloris e2e must be bounded on server, client, teardown, harness (ee5ffc2)
• learnings: Capture the wave-2 goose chase — primary evidence over plausible hypotheses (51f9d4e)
• learnings: Verify a duplication finding with a set-diff — the FFI mirrors are disjoint (a967f50)
• specs: Add SIPI security hardening wave 2 plan (cceab50)
• specs: Flatten spec folders into flat date-numbered files (ec1b690)
• specs: Record the JP2 decode watchdog mechanism (DEV-7080) (6bf8ff6)
• specs: Record the wave-2 CI stabilization journal (075e5aa)

Tests

• e2e: Isolate the cache dir of concurrent resource_limits servers (ae55eaa)
• e2e: Read the TIFF-JPEG body before deleting its source fixture (32ff41c)
• fuzz: Add codec round-trip encode fuzz targets (37c9ee4)
• fuzz: Disable ASan container-overflow check on the parser leg (bd056d8)
• fuzz: Drive the region/size-aware decode path from a header prefix (f93595d)
• fuzz: Lower the j2k decode fuzz max_len to raise throughput (80e883e)
• fuzz: Pin the DEV-7080 JP2 decode-hang reproducers (9a5fe00)
• fuzz: Silence libtiff warning flood and cap fuzz logs (84ca70d)

Build System

• deps: Bump curl to 8.21.0.bcr.1 (7edda83)
• deps: Bump exiv2 to 0.28.9 (5951a1f)
• deps: Bump lcms2 to 2.19.1 (c75e95d)
• deps: Bump libpng to 1.6.58 (8c6ef37)
• deps: Bump libtiff to 4.7.2 (fe63eb2)
• deps: Vendor libexpat 2.8.4 as a native cc_library (daa642a)

Miscellaneous Chores

• ci: Audit crate advisories over a checked-in lockfile (3d1afcf)
• ci: Harden the GitHub Actions supply-chain posture (df8e9a6)