v1.23.0-beta1 (2026-08-06)
Pre-release
Pre-release
- Dependency: on Clojars
- Versioning: Break Versioning
Sente v1.23 is a major security and hardening release focused on CSRF protection and
MessagePack improvements. It includes changes that may break a small minority of users -
please see the BREAKING section below.
As always please test carefully before using for anything important, and
please report any unexpected problems - thank you! 🙏
Since v1.22.0 (2026-07-02)
BREAKING
- [mod] MsgPack/gzip: bound decoder resources [394e189]
- [mod] MsgPack: standardize typed arrays [b3ce213]
- [mod] MsgPack: reject unsafe numeric conversions [4025b7c]
Fixes
- [sec] [#465] [#418] WebSocket: prepare protected CSRF transport [62dbcb8]
- [sec] [#465] [#418] Express: forward request headers [01ab938]
- [fix] [#446] Packers: preserve message order [4f14f2b]
- [fix] Ring: settle 3-arity async handlers [e4b3d07]
- [fix] Server: respect WS handshake closes [34ce9a2]
- [fix] Server: allow nil Ajax timeout [f743496]
- [fix] Adapters: preserve binary Ajax [99a41b9]
- [fix] Express: delegate CSRF validation [4661fea]
- [fix] Client: ignore superseded transports [f016e1f]
- [fix] Client: support Clojure 1.13 [7b25f70]
- [fix] Java client: receive binary frames [27c2be1]
- [fix] IDs: expand correlation entropy [dc64f54]
- [fix]
assert-event: return input [9accd93] - [fix] MsgPack: support unsigned int64 [373a4a5]
- [fix] MsgPack: reject invalid dates [244dca9]
- [fix] MsgPack: reject trailing input [76e410b]
- [fix] MsgPack: validate UUIDs [c602532]
- [fix] MsgPack: validate extension IDs [fe0476b]
- [fix] MsgPack: validate built-in extensions [d449df4]
- [fix] MsgPack: validate array widths [c302280]
- [fix] MsgPack: validate cached keys [650e5e4]
- [fix] MsgPack: preserve CLJS collections [65bd7e8]
- [fix] MsgPack: preserve negative zero [25b80d9]
- [fix] MsgPack: preserve UTF-8 BOM [f6543c1]