v0.23.7

Verikit v0.23.7 focuses on security hardening, Prisma adapter correctness, permission enforcement, safer uploads, and transactional pagination. It also strengthens CI supply-chain security and addresses vulnerable transitive dependencies.

Highlights

Secure upload processing

The server now provides a secure upload processing hook, creating a safer extension point for handling uploaded files.

Upload signatures are now verified before files are passed to storage, preventing invalid or incorrectly identified files from reaching the storage layer.

Stronger permission enforcement

Record-aware field permissions are now correctly enforced when returning list results.

Write permission evaluation has also been hardened to fail closed when a permission rule throws an error. A failing authorization rule can therefore no longer accidentally result in a write operation being permitted.

Field permission processing has additionally been optimized to avoid redundant permission checks during server operations.

Transactional list pagination

The Prisma adapter now supports transactional list pagination, allowing the list query and its associated count operation to execute within a consistent transaction.

This provides stronger consistency for paginated responses when underlying records may be changing concurrently.

Safer Prisma search

Search handling now treats SQL LIKE metacharacters as literal input where appropriate.

Characters with special LIKE semantics are no longer unintentionally interpreted as search patterns when they are intended to be part of the user's search value.

Additional tests cover the sorted literal-search path.

Prisma adapter reliability

Several Prisma adapter behaviours have been corrected and expanded with additional test coverage.

Scoped updates no longer depend on JavaScript this binding, removing an unnecessary execution-context dependency and making adapter behaviour more predictable.

Dependency security

Overrides have been introduced for vulnerable versions of:

• postcss
• nanoid

This ensures affected transitive dependency versions are replaced with safer releases within the dependency graph.

CI supply-chain hardening

GitHub Actions used by Verikit's CI workflows are now pinned to immutable commit SHAs rather than relying solely on mutable version tags.

This reduces the risk of upstream action tags changing unexpectedly or being compromised.

npm provenance metadata

Repository metadata has been added to support npm provenance and improve traceability between published Verikit packages and their source repository.

Testing and maintenance

This release adds and improves coverage around several of the hardened behaviours, including:

• Sorted literal search.
• Prisma adapter behaviour.
• Client integration fixture permissions.
• Permission-related behaviour.

Prettier formatting updates are also included across affected code.

Summary

v0.23.7 is primarily a security, correctness, and reliability release.

The most significant changes are stricter authorization behaviour, record-aware field permissions, upload signature verification before storage, safer Prisma searches, transactional pagination, hardened GitHub Actions, vulnerable dependency overrides, and improvements to the Prisma adapter.

Users running earlier v0.23.x releases should consider upgrading, particularly applications relying on file uploads, field-level permissions, Prisma-backed searching, or paginated resource APIs.

Full Changelog: v0.23.6...v0.23.7