Repository navigation

security: AppSec audit remediation (0.9.0) - #36

Merged

tcheeric merged 18 commits into

masterfrom

security/appsec-audit-remediation

Sep 24, 2026

Commits on Sep 24, 2026

fix(spring): carry the access token in the session cookie, not the session id
tcheeric
committed
23ac500
fix(spring): drop the undocumented body-field fallback for the NIP-98 proof
tcheeric
committed
4fd303a
fix(spring): fail closed on protected paths, and agree on what a path is
tcheeric
committed
f3f9d48
fix(spring): stop the auto-configuration defaults from failing open
tcheeric
committed
569df2b
fix(server): evict dead records from the in-memory stores
tcheeric
committed
d252fdd
ci: build, test and scan on every pull request
tcheeric
committed
f88bf0a
ci: stop Dependency-Check blocking on pre-existing CVEs, cache the NVD feed
tcheeric
committed
f65e79e
ci: add CodeQL analysis for Java
tcheeric
committed
40e3591
test(it): make the TypeScript checkout location configurable
tcheeric
committed
c0c37c8
ci: correct the Dependency-Check note, the 14 findings were not reproducible
tcheeric
committed
7f32eb9
ci: assert every interop vector file, not just one
tcheeric
committed
aae7cf6
test: cover the sweep under contention and logout idempotency
tcheeric
committed
04019f7
docs(changelog): add the Unreleased security section
tcheeric
committed
9f8a258
chore(release): 0.9.0
tcheeric
committed
f8babb5
security: restore cookie defaults lost under partial binding
tcheeric
committed
0637d97
docs: add an upgrade guide for the 0.9.0 breaking changes
tcheeric
committed
cc8385b
security: pin bcprov 1.85 and jackson-databind 2.21.5, add an OSV gate
tcheeric
committed
3a8c1e4
fix: read every module's dependency tree in the OSV scan
tcheeric
committed
6622235

Navigation Menu

Repository navigation

security: AppSec audit remediation (0.9.0) - #36

security: AppSec audit remediation (0.9.0)#36
tcheeric merged 18 commits into
masterfrom
security/appsec-audit-remediation

Commits on Sep 24, 2026

fix(spring): carry the access token in the session cookie, not the session id

fix(spring): drop the undocumented body-field fallback for the NIP-98 proof

fix(spring): fail closed on protected paths, and agree on what a path is

fix(spring): stop the auto-configuration defaults from failing open

fix(server): evict dead records from the in-memory stores

ci: build, test and scan on every pull request

ci: stop Dependency-Check blocking on pre-existing CVEs, cache the NVD feed

ci: add CodeQL analysis for Java

test(it): make the TypeScript checkout location configurable

ci: correct the Dependency-Check note, the 14 findings were not reproducible

ci: assert every interop vector file, not just one

test: cover the sweep under contention and logout idempotency

docs(changelog): add the Unreleased security section

chore(release): 0.9.0

security: restore cookie defaults lost under partial binding

docs: add an upgrade guide for the 0.9.0 breaking changes

security: pin bcprov 1.85 and jackson-databind 2.21.5, add an OSV gate

fix: read every module's dependency tree in the OSV scan