Skip to content

v0.84.2: fix the admin hang after login (token-cache dead promise)

Choose a tag to compare

View all tags
@glw907 glw907 released this 13 Jul 22:40
v0.84.2
f7e4cad

0.84.2

Fixed

  • Admin requests could hang indefinitely after login on a cold isolate. The installation-token
    cache stored the in-flight mint promise, and a fast-returning admin view (the bare /admin
    redirect) let the runtime cancel that mint, leaving a dead promise that every later admin
    request in the isolate awaited for the 55-minute TTL. The cache now stores only a successfully
    minted token. Affects consumers on roughly 0.77 and later (the shared admin shell load).

Consumers must: nothing. This is a drop-in bump; upgrade and redeploy. Diagnosis with live
production evidence: docs/internal/2026-07-13-admin-token-cache-poisoning.md.

Assets 2
Loading