Skip to content

[0.12.0] - 2026-09-11

Choose a tag to compare

View all tags
@patatoid patatoid released this 11 Sep 14:37
· 134 commits to master since this release
0.12.0
1a6531a
This commit was signed with the committer’s verified signature.
patatoid Pascal Knoth
GPG key ID: C174F3DBC17ABFF7
Verified
Learn about vigilant mode.

Added

  • [admin] token dashboard provides issuance charts, filtering, full-text search, token-chain details, claim inspection, and revocation controls
  • [admin] administration interface supports selectable Boruta, Gruvbox, and Nord themes
  • [cli] boruta and boruta_admin releases include a YAML command-line interface for administration resources
  • [gateway] native Phi model trains noise detection with degree-one and sparse degree-two terms over OpenAPI request contexts
  • [gateway] Phi request matching treats the root path as legal for every HTTP method
  • [gateway] Phi noise detection evaluates unmatched paths across the entire gateway
  • [gateway] Phi prediction accepts bounded recency-decayed request memory as context
  • [gateway] Phi memory can classify otherwise legal requests as contextual noise
  • [gateway] upstreams can train and apply noise cancellation from transient OpenAPI uploads while storing only the Phi binary
  • [infra] Disable file logging configuration environment variable

Changed

  • [admin] token dashboard and API default to tokens issued since the beginning of the current hour
  • [admin] sidebar sections reflect authorized scopes and remain expanded across nested dashboard routes
  • [admin] remove the redundant roles:manage:all scope from new installations and administration scope requests
  • [admin] new OAuth clients default to confidential
  • [admin] credential presentation template actions use clearer wording

Fixed

  • [admin] resource activity refreshes when navigating between routes
  • [admin] fix sidebar upstream navigation
  • [admin] form fields wrap correctly on mobile viewports
  • [auth] log oauth revocation requests subject
  • [infra] include the database migration that defaults OAuth clients to confidential

Security

  • [admin] token administration responses omit token values and other reusable secrets
  • validate DID public clients against the issuer, registered redirect URIs, and supported grant types
  • require secret authentication for client and agent credentials grants and introspection, including public clients
  • allow decentralized non-confidential public-client grants without a secret only when issuer-bound
Assets 2
Loading