Skip to content

[0.10.0] - 2026-06-12

Choose a tag to compare

View all tags
@patatoid patatoid released this 12 Jun 10:45
· 107 commits to master since this release
0.10.0
6636da0
This commit was signed with the committer’s verified signature.
patatoid Pascal Knoth
GPG key ID: C174F3DBC17ABFF7
Verified
Learn about vigilant mode.

Added

  • [gateway] HTTP and HTTPS forward proxies
  • [gateway] HTTPS gateway and sidecar listeners
  • [gateway] service registry root CA and node certificate generation
  • [gateway] service registry records expose node gateway and proxy listener configuration
  • [gateway] service registry records expose certificate paths and node certificates
  • [gateway] gateway listeners can be configured with BORUTA_GATEWAY_SERVER and BORUTA_GATEWAY_SIDECAR
  • [gateway] upstreams can require mTLS
  • [gateway] static configuration supports node aliases
  • [admin] service registry node upstreams are displayed in the upstreams section
  • [admin] gateway and proxy configuration is folded in service registry records
  • [auth] EPMD cluster hosts can be configured with LIBCLUSTER_HOSTS
  • [infra] docker compose runs multiple Boruta nodes with static gateway configuration

Changed

  • [gateway] mesh proxy traffic routes through service registry records
  • [admin] upstream creation and edition use service registry records
  • [infra] release node distribution and cookie can be configured with environment variables

Fixed

  • [gateway] service registry database notifications remain small when records include certificates and configuration

[0.9.2] - 2026-06-11

Added

  • [openid] integration tests for OID4VCI credential issuance and OID4VP direct post flows

Changed

  • [wallet] (breaking) credentials and key selection use password-protected local storage
  • [gateway] URI strip rewriting only updates the request-line path

Fixed

  • [auth] prompt and request object claims are validated before public client flows
  • [auth] prompt none requires a preauthenticated user
  • [auth] max age parameters must parse completely
  • [auth] WebAuthn state is cleared after authorization errors
  • [gateway] upstream TLS hostname verification
  • [gateway] HEAD request forwarding
  • [gateway] upstream matching ignores query strings and uses the longest matching upstream URI
  • [gateway] Authorization headers match bearer token schemes case-insensitively
  • [gateway] upstream store notifications are deduplicated
  • [gateway] malformed Content-Length responses are handled safely
  • [identity] auth flow state is cleared on logout
  • [identity] auth return query parameters are parsed correctly
  • [identity] sessions are marked chosen after user selection

[0.9.1] - 2026-06-01

Added

  • [gateway] upstreams can rate-limit traffic
  • [gateway] request and business event history in the administration dashboard
  • [admin] administrators can see user identifiers in user lists
  • [infra] operators can benchmark OAuth grants and gateway requests
  • [infra] request count documentation for OAuth and OpenID4VC flows

Changed

  • [auth] OAuth acceptor count can be configured and defaults to 8
  • [gateway] gateway acceptor count can be configured
  • [gateway] authorization returns clearer OAuth error responses
  • [gateway] upstream authorization includes configured scopes
  • [gateway] keepalive tuning is removed from gateway configuration
  • [infra] deployment secrets are provided through environment variables
  • [admin] gateway configuration fields are easier to read
  • [admin] user displays prefer usernames over emails

Fixed

  • [admin] verifiable credential array claims can be deleted
  • [admin] feedback form
  • [admin] gateway dashboard request times graph
  • [gateway] upstream routes match paths correctly
  • [gateway] empty forwarded token headers are ignored
  • [gateway] successful requests appear in logs
  • [identity] users are redirected correctly after federated sign in
  • [identity] federation error pages render correctly

Security

  • [admin][identity] upgrade vulnerable npm packages
  • [auth] OAuth token state values are handled without atom exhaustion risk
  • [gateway] reduce exposure of local runtime artifacts in container builds
  • [gateway] malformed requests are handled more safely
  • [identity] user settings values are handled without atom exhaustion risk
  • [identity] development environment defaults are sanitized
  • [infra] aggregate log responses are size-limited
  • [infra] redact OAuth credentials from logs
  • [infra] remove local deployment secrets
  • [web] close presentation SSE streams when clients disconnect
  • [web] require secure cookies
Assets 2
Loading