Skip to content

Slingshot v0.3.1 — Auth hardening

Choose a tag to compare

View all tags
@jddalessandro jddalessandro released this 23 Jul 19:48
v0.3.1
352107f

Security-focused patch release for Slingshot authentication and supporting packages.

Highlights:

  • Auth configuration now fails closed on unknown schema-owned keys instead of silently dropping misspelled protections.
  • AES-256-GCM decryption enforces a 16-byte authentication tag and 12-byte IV.
  • Hardened session binding, refresh rotation, cookie deletion, OAuth identity verification, bearer credentials, account-state checks, and default security headers.
  • Removed dynamic-regex cache invalidation paths and guarded scoped property traversal.
  • Updated dependency graph with zero known Bun advisories and zero HIGH/CRITICAL findings in the deployed pentest image.

Compatibility note: applications with unknown auth configuration keys will now fail startup. Follow the migration table in the auth security documentation and correct each reported key.

Primary package versions: @lastshotlabs/slingshot-auth 0.2.3, @lastshotlabs/slingshot-core 0.2.3, and coordinated patch releases for OAuth, OIDC, M2M, SCIM, and runtimes.

Assets 2
Loading