v1.80.1

sluis v1.80.1

Image	ghcr.io/truvity/sluis/sluis:1.80.1
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.80.1
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.80.1
Chart	oci://ghcr.io/truvity/charts/sluis:1.80.1
TypeScript	@truvity/sluis@1.80.1 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.80.1

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.80.1_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.80.1_linux_arm64.zip,
sluis-slack_1.80.1_linux_arm64.zip, sluis-google_1.80.1_linux_arm64.zip,
sluis-outline_1.80.1_linux_arm64.zip, sluis-cloudflare_1.80.1_linux_arm64.zip and
sluis-backup_1.80.1_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• e2a8132: fix(deps): update all non-major dependencies (@truvity-renovate-public[bot])
• 7003b4c: fix(deps): tidy deploy/pulumi/edge/cloudflare for the policy bump (@excavador)
• 65059e5: fix(deps): update all non-major dependencies (@truvity-renovate-public[bot])

Other

• 4c9c5bd: ci(renovate): tidy every Go module after a Go dependency update (@excavador)

v1.80.0

sluis v1.80.0

Image	ghcr.io/truvity/sluis/sluis:1.80.0
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.80.0
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.80.0
Chart	oci://ghcr.io/truvity/charts/sluis:1.80.0
TypeScript	@truvity/sluis@1.80.0 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.80.0

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.80.0_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.80.0_linux_arm64.zip,
sluis-slack_1.80.0_linux_arm64.zip, sluis-google_1.80.0_linux_arm64.zip,
sluis-outline_1.80.0_linux_arm64.zip, sluis-cloudflare_1.80.0_linux_arm64.zip and
sluis-backup_1.80.0_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• 3e76b76: feat(compile): read-only CI job identities for pull requests (@excavador)

Bug Fixes

• a7dc40f: fix(hack): test-release-gate scrubs the hook's GIT_DIR; trim guide (@excavador)
• bf9795d: fix(deps): go-jose v4 4.1.6, chi v5 5.4.0 (Dependabot #44-#48) (@excavador)

Other

• 45d02d6: chore(renovate): lock file maintenance follows the shared weekly schedule (@excavador)
• ea92963: ci: ci-workflows v5.9.0, ci-actions v3.7.0 (@excavador)

v1.79.4

sluis v1.79.4

Image	ghcr.io/truvity/sluis/sluis:1.79.4
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.79.4
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.79.4
Chart	oci://ghcr.io/truvity/charts/sluis:1.79.4
TypeScript	@truvity/sluis@1.79.4 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.79.4

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.79.4_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.79.4_linux_arm64.zip,
sluis-slack_1.79.4_linux_arm64.zip, sluis-google_1.79.4_linux_arm64.zip,
sluis-outline_1.79.4_linux_arm64.zip, sluis-cloudflare_1.79.4_linux_arm64.zip and
sluis-backup_1.79.4_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 386b3d5: fix(audit): reread the store's credential after a 401 as after a 403 (@excavador)

Other

• 1bfcda3: docs(audit): keep the archive-on-r2 guide within its word budget (@excavador)
• 0cbe65e: ci(site): rebuild sluis.id on a v1 release tag; remove pages.yaml (@excavador)

v1.79.3

sluis v1.79.3

Image	ghcr.io/truvity/sluis/sluis:1.79.3
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.79.3
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.79.3
Chart	oci://ghcr.io/truvity/charts/sluis:1.79.3
TypeScript	@truvity/sluis@1.79.3 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.79.3

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.79.3_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.79.3_linux_arm64.zip,
sluis-slack_1.79.3_linux_arm64.zip, sluis-google_1.79.3_linux_arm64.zip,
sluis-outline_1.79.3_linux_arm64.zip, sluis-cloudflare_1.79.3_linux_arm64.zip and
sluis-backup_1.79.3_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• fe3de0d: fix(cloudflare): count the on-demand caps from the record, not Cloudflare's list (@excavador)
• 3db7902: fix(cloudflare): count the reconcile time in the record's room before adding to it (@excavador)

Other

• 385dafd: docs(changelog): a mint's trace no longer lists the account (@excavador)

v1.79.2

sluis v1.79.2

Security release for GHSA-m7q8-643q-pjjf (medium). Upgrade from any version up to 1.79.1. Before upgrading, check that no client in the policy uses a plain http:// redirect or signed-out URI to a host other than 127.0.0.1, [::1] or localhost, and that no public client sends a client secret. Tokens issued before the upgrade stay valid until they expire.

Image	ghcr.io/truvity/sluis/sluis:1.79.2
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.79.2
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.79.2
Chart	oci://ghcr.io/truvity/charts/sluis:1.79.2
TypeScript	@truvity/sluis@1.79.2 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.79.2

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.79.2_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.79.2_linux_arm64.zip,
sluis-slack_1.79.2_linux_arm64.zip, sluis-google_1.79.2_linux_arm64.zip,
sluis-outline_1.79.2_linux_arm64.zip, sluis-cloudflare_1.79.2_linux_arm64.zip and
sluis-backup_1.79.2_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 2eb543c: fix(issuer): tighten token checks (@excavador)

v1.79.1

sluis v1.79.1

Image	ghcr.io/truvity/sluis/sluis:1.79.1
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.79.1
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.79.1
Chart	oci://ghcr.io/truvity/charts/sluis:1.79.1
TypeScript	@truvity/sluis@1.79.1 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.79.1

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.79.1_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.79.1_linux_arm64.zip,
sluis-slack_1.79.1_linux_arm64.zip, sluis-google_1.79.1_linux_arm64.zip,
sluis-outline_1.79.1_linux_arm64.zip, sluis-cloudflare_1.79.1_linux_arm64.zip and
sluis-backup_1.79.1_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 5f3f784: fix(chart): read the tick counter in SluisTickStale and SluisTickSeriesStale (@excavador)
• e71f50a: fix(issuer,chart): record Cloudflare mints as token_mint; trace Cloudflare API calls (@excavador)

v1.79.0

sluis v1.79.0

Image	ghcr.io/truvity/sluis/sluis:1.79.0
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.79.0
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup,outline}:1.79.0
Chart	oci://ghcr.io/truvity/charts/sluis:1.79.0
TypeScript	@truvity/sluis@1.79.0 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.79.0

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.79.0_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.79.0_linux_arm64.zip,
sluis-slack_1.79.0_linux_arm64.zip, sluis-google_1.79.0_linux_arm64.zip,
sluis-outline_1.79.0_linux_arm64.zip, sluis-cloudflare_1.79.0_linux_arm64.zip and
sluis-backup_1.79.0_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• 8898d9d: feat(outline): reconcile Outline workspaces, groups and collections from policy (@excavador)
• 11ccbd2: feat(outline): console page, Lambda schedule, docs and lint (@excavador)
• fb6ceb9: feat(outline): the Outline controller is a module of its own (@excavador)

Other

• 2d812a0: test(connectalias): the Outline service is the twelfth file of both packages (@excavador)

v1.78.3

sluis v1.78.3

Image	ghcr.io/truvity/sluis/sluis:1.78.3
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.78.3
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.78.3
Chart	oci://ghcr.io/truvity/charts/sluis:1.78.3
TypeScript	@truvity/sluis@1.78.3 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.78.3

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.78.3_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.78.3_linux_arm64.zip,
sluis-slack_1.78.3_linux_arm64.zip, sluis-google_1.78.3_linux_arm64.zip,
sluis-cloudflare_1.78.3_linux_arm64.zip and
sluis-backup_1.78.3_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• f43ef9a: fix(audit): bound and parallelise the writer's catalogue upload at init (@excavador)
• 49d6cfa: fix(chart): SluisTickStale is critical only for a live target; a stopped series is a warning (@excavador)

v1.78.2

sluis v1.78.2

Image	ghcr.io/truvity/sluis/sluis:1.78.2
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.78.2
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.78.2
Chart	oci://ghcr.io/truvity/charts/sluis:1.78.2
TypeScript	@truvity/sluis@1.78.2 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.78.2

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.78.2_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.78.2_linux_arm64.zip,
sluis-slack_1.78.2_linux_arm64.zip, sluis-google_1.78.2_linux_arm64.zip,
sluis-cloudflare_1.78.2_linux_arm64.zip and
sluis-backup_1.78.2_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 75f0747: fix(console): Re-check finds a GitHub App installed directly on GitHub (@excavador)
• 1d5a58d: fix(chart): SluisTickStale ignores series that stopped reporting (@excavador)
• 181a3d6: fix(deploy): hold a key's aliases to its administrators (@excavador)
• c8491c1: fix(audit): report an existing archive bucket without the lock guard (@excavador)
• 7859adf: fix(issuer): check the Google sign-in's nonce and pin an address to its sub (@excavador)
• 23beb83: fix(issuer,github): name the fields of an auth request error; warn once on unconsumed groups (@excavador)
• d3a01ea: fix(issuer): sanitise a request's values in the auth request line (@excavador)
• 74bc21b: fix(issuer): log the auth request error as sanitised fields, not as a value (@excavador)
• 5e39ce5: fix(issuer): sanitise the auth request error code too (@excavador)
• e221ac1: fix(telemetry): token route, zero-primed counters, Lambda init and AWS call panels (@excavador)
• 9de752e: fix(deps): update module github.com/truvity/cnpg/v2 to v2.35.0 (@truvity-renovate-public-roster[bot])

Other

• fe97e4f: style(console): shorten the re-check test lines and lowercase the log message (@excavador)
• 204fee6: ci: ci-workflows v5.4.0; Go build and module caches on the hosted runners (@excavador)
• 06ce157: ci(release): publish only a commit on master whose CI passed (@excavador)
• 54d7097: test(issuer): keep the auth request level cases under the line limit (@excavador)

v1.78.1

sluis v1.78.1

Image	ghcr.io/truvity/sluis/sluis:1.78.1
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.78.1
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.78.1
Chart	oci://ghcr.io/truvity/charts/sluis:1.78.1
TypeScript	@truvity/sluis@1.78.1 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.78.1

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.78.1_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.78.1_linux_arm64.zip,
sluis-slack_1.78.1_linux_arm64.zip, sluis-google_1.78.1_linux_arm64.zip,
sluis-cloudflare_1.78.1_linux_arm64.zip and
sluis-backup_1.78.1_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• b3f067b: feat(policy): limit which clients an identity may exchange for (@excavador)

Bug Fixes

• b94e45b: fix(sluisctl): cache Cloudflare credential refusals and never retry 429s (@excavador)

Other

• 742ff81: chore(deps): update all non-major dependencies (@truvity-renovate-public-roster[bot])