v1.0.3 - ORBIT - Security Patch & Platform Onboarding

[focusjordan]

This release introduces critical security patches for ORBIT API nodes, alongside a major new feature set for platform credential management and onboarding. Learn more at GHSA-hv63-xq67-46mj

Security Updates (High Priority)

Patched CWE-400 (Memory Exhaustion): Replaced custom streaming CBOR ingestion with native express.raw() middleware. This enforces strict payload byteguards (100kb anonymous / 5mb authenticated) before data parsing occurs, preventing Denial of Service (DoS) attacks via memory exhaustion.

Enforced Strict Authentication: platformAuth is now strictly required across all compute-heavy and state-reading endpoints (/verify, /watermarkmatch, /chain, /similar, /analyze). Anonymous access to these endpoints has been disabled.

New Features
Platform Onboarding & Credential Rotation: Implemented a complete suite of handlers (src/api/handlers/platform.js) and ledger queries for securely onboarding new platforms and rotating Ed25519 keypairs.

End-to-End Integration Tests: Added a comprehensive E2E test suite (tests/api/platform-onboarding.test.js) to validate the new platform credential lifecycles.

Housekeeping
Demo Clean-up: Untracked the demo/ directory from version control to streamline the core protocol repository.

⚠️ Breaking Changes

If you are hosting an ORBIT node, you must pull v1.0.3 immediately. Integrations relying on unauthenticated requests to v1.0.1 and v1.0.2 endpoints will now receive a 401 Unauthorized and must be updated to provide X-ORBIT-Platform, X-ORBIT-API-Key, and X-ORBIT-Signature headers.

---

This discussion was created from the release v1.0.3 - ORBIT - Security Patch & Platform Onboarding .