Repository navigation
Auton 1.3.2
OIDC token exchange now enforces the existing five-second budget across the
complete request, including response headers and body. A server that trickles
bytes can no longer extend authentication indefinitely by avoiding individual
socket timeouts. The bounded helper is terminated and reaped on expiry.
Certificate verification, response-size limits, denied/unavailable distinctions,
and the refusal to follow redirects or retry token exchanges are preserved.
Credentials are passed through the helper's private input, not command arguments.
Existing HTTP Basic authentication and job execution behavior are unchanged.
Both auton and autond are released at 1.3.2. Upgrade the client with
python -m pip install --upgrade 'auton[textual]==1.3.2' and use
decryptus/auton:1.3.2 for the daemon image. Review your configuration and use
the existing explicit daemon restart procedure after an upgrade.