v1.1.2 - SDK Release, Security Hardening, and Payload Stability
PLEASE UPDATE TO V.1.1.2 TO ENSURE YOU ARE UP TO DATE WITH ALL SECURITY IMPROVEMENTS
The official ORBIT SDK is now publicly available on NPM.
Alongside this public release, v1.1.2 prioritizes structural integrity, vulnerability mitigation, and the stabilization of the forensic analysis engine. The entire ORBIT architecture has now been unified under a single semantic version (v1.1.2) to ensure dependency alignment across all environments.
You can view our full Security advisory at GHSA-5xp2-vr4q-677v
The Official ORBIT SDK
Public NPM Release: The ORBIT SDK is now officially published to NPM, providing a standardized, secure client interface for enterprise integrations.
API v2 Documentation: V2 API methods are now thoroughly documented within the SDK, including updated default registry URLs and strict integration guidelines.
Security Hardening & Vulnerability Mitigation
This cycle aggressively addresses potential execution and traversal vulnerabilities within the middleware layer.
Command Injection Eradication: All instances of execSync have been fundamentally replaced across the shell script and fingerprinting infrastructure. This explicitly eliminates vector points for arbitrary command execution.
Path Traversal Patches: Implemented strict path sanitization within the DDEX ingest logic, configuration parsing, and audit log generation to explicitly prevent directory traversal attacks.
Dependency CVE Resolution: Resolution of CVEs in the dependency tree via npm overrides. This patches a severe Denial of Service (DoS) vector in js-yaml (GHSA-h67p-54hq-rp68) and multiple vulnerabilities within protobufjs.
Concurrency Stabilization: Resolved a race condition specific to B2B transfer handling.
Repository Hygiene: Strictly excluded administrative keys (private-admin/) and internal datasets (panns-data) from repository visibility to protect operational security.
Forensics & Payload Stability
The underlying mathematical and metadata engines have been refined to handle edge-case payloads and expand capabilities.
SilentCipher Integration: The metadata pipeline now officially integrates the @ohnrshyp/watermark package, bringing robust SilentCipher capabilities to the core engine.
Pre-Hash Protocol Alignment: Resolved a protocol mismatch specific to base64 audio payloads, ensuring the non-blocking validation introduced in v1.1.0 functions identically across both raw binary and base64 transmission formats.
Forensics Engine: Resolved a critical bug causing analytical failures on 44.1kHz audio samples. Additionally patched subsequent NameError exceptions, key mismatches, and duplicate JSON key generation during output mapping.
Payload Scaling: The maximum allowable CBOR payload limit has been increased to 100MB to support uncompressed, extended-duration ingestions.
Monorepo Architecture & CI Isolation
To support scaling development and isolated testing, the repository architecture has been overhauled.
Unified Versioning: Implemented Lerna and expanded npm workspaces. All internal and standalone packages are now strictly version-aligned.
CI/CD Optimization: Restructured GitHub Actions to physically isolate heavy Machine Learning tests from standard unit tests. This prevents pipeline bottlenecks and ensures rapid feedback loops. Key-dependent API tests were removed in favor of mock structures, while retaining core authentication tests.
Cross-Platform Alignment: Standalone packages have been updated to support Windows Python environments, complete with dedicated sanity tests and the systematic removal of dead code.
API & Resilience
Connection Resilience: Introduced automated database connection retrying to guarantee stability and fault tolerance under sub-optimal network conditions.