v3.9.2

What's Changed

• Verify operator WebSocket access tokens before RBAC and render Liquid… by @emirhandurmus in #870
• Trust an external HTTPS OIDC issuer signed by a private CA without tu… by @emirhandurmus in #871

Full Changelog: v3.9.1...v3.9.2

Added

• External OIDC issuer CA — OIDC_ISSUER_TLS_PATH_CA (auth.issuer.tls.path.ca) or OIDC_ISSUER_TLS_BASE64_CA (auth.issuer.tls.base64.ca) trusts an HTTPS issuer signed by a private CA. Path wins when both are set. The CA is added to the Mozilla roots for discovery, the token call, and JWKS only. Certificate checks stay on. Embedded mode ignores these keys.

Changed

• Dockerfile base image digest pins refreshed for node:24-bookworm (console-builder and builder) and ubi9/nodejs-24-minimal.

Fixed

• Operator WebSocket access tokens — user exec and log upgrades verify the access token (signature, issuer, audience, and expiry) before RBAC. An unsigned token, an expired token, a refresh token, or a token for another issuer or audience is rejected. Agent exec and log sockets still use the fog token. (CWE-347)
• Template rendering — Liquid substitution on POST, PUT, and PATCH runs only after RBAC. The engine refuses template file reads, and it rejects a range wider than 10,000 or a render that passes 100,000 for iterations. (CWE-400)