Skip to content

v1.0.46

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jul 23:38
v1.0.46
660b025
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release: two hardening changes from the EDB Security Design Review follow-ups.

  • ZAF SDK pinned with Subresource Integrity (tsanetgit/Zendesk_App#94): the SDK now loads from an exact-version URL with an integrity hash, so a tampered or unexpectedly changed SDK is blocked by the browser.
  • Optional app-level RBAC on TSANet actions (tsanetgit/Zendesk_App#97): new Allowed action roles setting restricts which Zendesk roles can invoke Accept / Reject / Request Info / Add Note / Close / New Collaboration. Empty (default) keeps current behavior, so no action is needed on existing installs unless you want the restriction. Defense-in-depth for the UI; the TSANet Connect API remains the authorization boundary.

Verify provenance before install:

gh attestation verify tsanet-connect-v1.0.46.zip --repo tsanetgit/Zendesk_App
sha256sum -c checksums.txt

Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

Assets 4
Loading