Skip to content
This repository has been archived by the owner on Apr 5, 2023. It is now read-only.

rp-adapter: update hydra #336

Open
llorllale opened this issue Oct 3, 2020 · 0 comments
Open

rp-adapter: update hydra #336

llorllale opened this issue Oct 3, 2020 · 0 comments
Labels
Milestone

Comments

@llorllale
Copy link
Contributor

We are using a really old version of Hydra (1.3.2) and the latest was just released today (1.8.5).

Several security vulnerabilities have been addressed since 1.3.2:

  • 1.4.0: potential replay of private_key_jwt JWTs when performing client authorization (BREAKING CHANGE: This patch requires a new SQL Table which needs to be created using hydra migrate sql. No other breaking changes have been introduced by this patch.)
  • 1.8.5: CVE-2020-15234, CVE-2020-15223, CVE-2020-15233

Other changes of note:

  • 1.5.0-beta1: introduces a breaking change that requires running hydra migrate sql before applying this release.
  • 1.5.1: does not contain breaking changes but please run hydra migrate sql once you have backed up the database
  • 1.7.0: not relevant for us: breaking change affecting user consent revocation flow
  • 1.7.4: requires SQL migrations
@llorllale llorllale added the chore label Oct 3, 2020
@llorllale llorllale added this to the 0.1.5 milestone Oct 3, 2020
@llorllale llorllale self-assigned this Oct 3, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

1 participant