1.292.40 – Oct 17, 2026

1.292.40 (2026-10-18)

Upgrade warning: This fix can change access in either direction by discovering previously missed package annotations and selecting the nearest package policy. Review application and dependency package-info declarations and allowed and denied requests before upgrading. See the package policy migration guidance.

Bug Fixes

• authentication: backport package policies (review access rules before upgrading) (#528) (3116718)

  Upgrade warning: discovering previously missed package annotations and selecting the nearest package policy can change access in either direction. Review application and dependency package-info declarations and allowed and denied requests before upgrading.

  Resolve ancestor authorization policies in the payload or handler module and defining loader, preserving deterministic policy selection across application classloaders. Keep type and method overrides and the combined requirements of the selected policy.

  Recheck access per invocation and propagate silent refusal without producing successful null responses. Preserve prepared local handling, avoid redundant identity lookup and temporary role collections, and retain deferred completion, cancellation, context, mirroring and custom interceptor contracts.

  See https://fluxzero.io/docs/guides/messaging/role-based-access-control/#role-annotations-support-nesting-and-overrides for the package policy migration.

  Retain maintenance APIs and defaults; exclude unrelated 2.x features. Main-line counterpart: #500.