v0.10.2

What's in this release

A security patch for installations that run vault-gated operations from the command line.

CLI access control now applies to queue workers and the scheduler

Symfony Messenger workers and scheduler runs start under an unauthenticated command-line user. The vault treated that placeholder as a real backend user, with two consequences: the configured CLI access rules never applied in those contexts, and — because the placeholder carries user id 0 — it matched secrets owned by user 0, granting read and delete even when CLI access was switched off.

Such runs are now evaluated against the CLI access configuration as intended. Authenticated command-line users keep their normal permissions, and web requests are unaffected.

Operators who run Messenger workers or scheduled tasks that read secrets, and who rely on the CLI access settings, should upgrade.

Installation

composer require netresearch/nr-vault

Publication status

• TER: extensions.typo3.org/extension/nr_vault — 0.10.2 verified
• Packagist: packagist.org/packages/netresearch/nr-vault — 0.10.2 verified
• Documentation: docs.typo3.org/p/netresearch/nr-vault/0.10/en-us/ — render verified

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-vault-0.10.2.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-vault-0.10.2.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.