v1.0.3 - ORBIT - Security Patch & Platform Onboarding
This release introduces critical security patches for ORBIT API nodes, alongside a major new feature set for platform credential management and onboarding. Learn more at GHSA-hv63-xq67-46mj
Security Updates (High Priority)
Patched CWE-400 (Memory Exhaustion): Replaced custom streaming CBOR ingestion with native express.raw() middleware. This enforces strict payload byteguards (100kb anonymous / 5mb authenticated) before data parsing occurs, preventing Denial of Service (DoS) attacks via memory exhaustion.
Enforced Strict Authentication: platformAuth is now strictly required across all compute-heavy and state-reading endpoints (/verify, /watermarkmatch, /chain, /similar, /analyze). Anonymous access to these endpoints has been disabled.
New Features
Platform Onboarding & Credential Rotation: Implemented a complete suite of handlers (src/api/handlers/platform.js) and ledger queries for securely onboarding new platforms and rotating Ed25519 keypairs.
End-to-End Integration Tests: Added a comprehensive E2E test suite (tests/api/platform-onboarding.test.js) to validate the new platform credential lifecycles.
Housekeeping
Demo Clean-up: Untracked the demo/ directory from version control to streamline the core protocol repository.
If you are hosting an ORBIT node, you must pull v1.0.3 immediately. Integrations relying on unauthenticated requests to v1.0.1 and v1.0.2 endpoints will now receive a 401 Unauthorized and must be updated to provide X-ORBIT-Platform, X-ORBIT-API-Key, and X-ORBIT-Signature headers.