v0.4.23 — Security catch-up

v0.4.23 — Security catch-up

This release includes the October 13 security implementation and dependency updates. Upgrade both the Go CLI and the optional Rust sidecar to receive the complete update.

What changed

• SAML structural alerts: Auth Fortress detects duplicate IDs, displaced assertions, mismatched signature references, unsigned plaintext assertions, unsafe XML constructs, and inspection-limit violations in supplied saml_response telemetry.
• Trusted agent authority: MCP registration checks no longer accept unverified bearer-token role claims. Agent delegation requires a verified attestation, bound identities, and a future expiry. Linked Token Vault grants expire, renew correctly, and require both user and agent identities during tool-use monitoring.
• Exfiltration detection: LLM Firewall correlates sensitive-file reads, encoding, and outbound HTTP requests within 60 seconds. Destination checks parse actual hostnames, and concurrent web-taint processing uses the existing lock.
• Go security updates: Go 1.26.9, compress v1.18.7, x/crypto v0.56.0, and x/sys v0.47.0.
• Rust maintenance: maintained yaml_serde v0.10.7 replaces the unmaintained YAML backend; chacha20 moves to v0.10.2. Configuration format compatibility is preserved.

Upgrade and integration requirements

Download the archive matching your operating system and architecture from this release. If you use the Rust sidecar, download its matching engine binary as well. Verify the checksum manifests, Sigstore bundles, and GitHub artifact attestations before installation. Linux and macOS installer users can select this version with sh install.sh --version v0.4.23 from the repository checkout.

The release supplies Go archives and Rust sidecars for Linux, macOS, and Windows on amd64 and arm64. Go archives have SBOMs. Prebuilt Rust sidecars use the existing portable configuration without optional packet capture or PQC features; build from source to enable those features.

SAML inspection requires event telemetry and is structural: your service provider must still verify signatures, trusted issuers, audience, lifetime, and replay. Delegation integrations must supply boolean attestation_verified: true only after trusted verification; missing verification now generates alerts. These telemetry checks do not replace an identity provider or an authorization service.

Verification and remaining work

The implementation passed Go tests with race detection, build, vet, staticcheck, Gosec, vulnerability reachability checks, Rust tests and static checks, and repository dependency gates. The release workflow repeats its quality gates and builds the published targets.

Govulncheck finds no affected imported Go package or reachable function. An unused deprecated OpenPGP advisory remains in the required crypto module. Five existing optional PQC/paste maintenance warnings remain tracked for provider migration. Live packet capture was not exercised in this cycle.

See implementation notes and telemetry contracts and the changes since v0.4.21.