v1.8.9-rise.2

What's Changed

Other Changes 📚

• Make fork CI self-contained by @NiklasRosenstein in #3
• Carry upstream scope override fix by @NiklasRosenstein in #1
• Add scoped override allowlists by @NiklasRosenstein in #4

New Contributors

• @NiklasRosenstein made their first contribution in #3

Full Changelog: v1.8.9-rise.1...v1.8.9-rise.2

---

Vault operator summary

This Rise fork release adds tighter controls for token scope overrides in the Artifactory secrets engine.

Vault operators can now move beyond the previous all-or-nothing allow_scope_override behavior. The fork supports three modes:

• disabled / false: deny caller-provided scope overrides.
• global / true: preserve the previous global override behavior.
• opt-in: require the role or user-token config to explicitly allow overrides.

This release also adds scope allowlists:

• default_allowed_scopes on config/admin
• allowed_scopes on roles
• allowed_scopes on config/user_token and per-user token config

When callers request a custom scope, the plugin validates each requested scope entry against the configured allowlist before asking Artifactory to issue the
token. This gives operators a practical way to permit narrow self-service token scopes without allowing arbitrary Artifactory permissions.

The release also carries the upstream fix that enforces allow_scope_override for user_token/:username scope overrides.

Operational impact

Existing configurations that do not use scope overrides should continue to behave as before.

Operators using scope overrides should review their config/admin, role, and user-token configuration and set the intended override mode explicitly. For delegated
or self-service token issuance, prefer opt-in with narrow allowed_scopes patterns.

Validation

Unit tests passed for this release with:

GOCACHE=/tmp/codex-go-cache go test -count=1 ./...

v1.8.9-rise.1

Full Changelog: v1.8.9...v1.8.9-rise.1