build: bump the gradle-minor-and-patch group with 7 updates by dependabot[bot] · Pull Request #22 · codeheadsystems/mini-auth

dependabot · 2026-10-15T11:54:16Z

Bumps the gradle-minor-and-patch group with 7 updates:

Package	From	To
gradle-wrapper	`9.8.0`	`9.8.1`
com.codeheadsystems:pk-auth-core	`2.2.0`	`2.3.0`
com.codeheadsystems:pk-auth-jwt	`2.2.0`	`2.3.0`
com.codeheadsystems:pk-auth-magic-link	`2.2.0`	`2.3.0`
com.codeheadsystems:pk-auth-otp	`2.2.0`	`2.3.0`
com.codeheadsystems:pk-auth-backup-codes	`2.2.0`	`2.3.0`
com.codeheadsystems:pk-auth-testkit	`2.2.0`	`2.3.0`

Updates gradle-wrapper from 9.8.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

Unauthenticated worker-to-daemon channel deserializes untrusted Java objects

Deserialization of untrusted Java objects before authentication in the client - daemon communication

Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

[Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)

Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)

Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:
./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper
See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

39daf39 Release notes for Gradle 9.8.1 (#39409)
4fc92e5 Release notes for Gradle 9.8.1
bfbd14a Make repository disabling stricter (#39403)
95e0bf9 Check daemon & worker preamble earlier (#39402)
7aa9a5b Improve display for distribution url in wrapper (#39401)
74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
651110a Check worker token before any serialization similarly to daemon
8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
f28e514 Check the daemon token before any serialization
86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
Additional commits viewable in compare view

Updates com.codeheadsystems:pk-auth-core from 2.2.0 to 2.3.0

Release notes

Sourced from com.codeheadsystems:pk-auth-core's releases.

Release 2.3.0

pk-auth 2.3.0

Maven Central

Add the modules you need (all share the same version):
implementation("com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0")
// or :pk-auth-dropwizard / :pk-auth-micronaut for the other adapters
implementation("com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0")
// testImplementation("com.codeheadsystems:pk-auth-testkit:2.3.0")
<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>pk-auth-spring-boot-starter</artifactId>
  <version>2.3.0</version>
</dependency>
Modules Published

com.codeheadsystems:pk-auth-core:2.3.0

com.codeheadsystems:pk-auth-jwt:2.3.0

com.codeheadsystems:pk-auth-admin-api:2.3.0

com.codeheadsystems:pk-auth-backup-codes:2.3.0

com.codeheadsystems:pk-auth-magic-link:2.3.0

com.codeheadsystems:pk-auth-otp:2.3.0

com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0

com.codeheadsystems:pk-auth-persistence-dynamodb:2.3.0

com.codeheadsystems:pk-auth-testkit:2.3.0

com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0

com.codeheadsystems:pk-auth-dropwizard:2.3.0

com.codeheadsystems:pk-auth-micronaut:2.3.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

chore: open 2.3.0 development line by @wolpert in codeheadsystems/pk-auth#105

v2.2.0 by @wolpert in codeheadsystems/pk-auth#106

build(deps): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in codeheadsystems/pk-auth#107

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#108

build(deps): Bump the dev-dependencies group with 4 updates by @dependabot[bot] in codeheadsystems/pk-auth#109

build(deps-dev): Bump @types/node from 26.0.1 to 26.1.0 in /clients/passkeys-browser in the npm-dependencies group across 1 directory by @dependabot[bot] in codeheadsystems/pk-auth#110

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#111

... (truncated)

Changelog

Sourced from com.codeheadsystems:pk-auth-core's changelog.

[2.3.0] - 2026-10-08

A security and maintainability release. The Security entries close findings from a full-project audit. The remaining entries come from an architecture review of the ceremony engine and the three adapters, a documentation style pass, and dependency updates.

Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), which changes username uniqueness semantics; the entry on JDBI username uniqueness below carries the details. Magic-link hosts that read SendResult.Sent.tokenJti move to the renamed jti component; the first Security entry carries the details.

Security

Magic-link SendResult.Sent no longer carries the login token. The record component was named tokenJti but held the complete signed magic-link JWT, a bearer credential that authenticates as the user without inbox access. A host logging or echoing what its name advertised as an opaque correlation id was publishing a working login credential. Sent now carries the real jti; the token reaches only the configured EmailSender. Breaking: the component is renamed tokenJti → jti and its value changes, so hosts that recovered the token from the result (e.g. to render their own email) must instead capture it in a MessageFormatter / EmailSender. startLogin's enumeration-resistant short-circuit paths continue to return Sent("").

Usernames are bounded and the in-memory rate-limiter caches can no longer grow without limit. Nothing capped username length (the JDBI column is Postgres TEXT), and both Caffeine caches used expireAfterWrite with no maximumSize. On the permitAll start endpoints, a caller varying its username grew the maps with its own key variety rather than with the number of real users, and every distinct key was retained for the full window. StartRegistrationRequest.MAX_USERNAME_LENGTH (256, enough for an email address) now bounds both start requests, and InMemoryCeremonyRateLimiter / InMemoryWindowCounter cap their maps at DEFAULT_MAX_TRACKED_KEYS (100 000). An over-long username is refused as a clean 400, covered by an adapter-level test asserting the refusal reaches the client as a 400 and not a 500. StartAuthenticationRequest still accepts a null username (the usernameless / discoverable-credential flow).

The per-username ceremony rate limit can no longer be bypassed by varying case. UserLookup implementations resolve usernames case-insensitively (DynamoDbUserLookup lower-cases the identity key), but the ceremony service passed the raw request string to CeremonyRateLimiter.tryAcquireForUsername, so alice, Alice, and ALICE drew on three independent budgets against one account, and an 8-character username yielded 256 of them. The per-IP bucket did not compensate: the per-username bucket exists for the distributed case, which is exactly the case the split defeated. The service now case-folds (toLowerCase(Locale.ROOT)) before consulting the limiter, so every CeremonyRateLimiter, including a host's shared Redis implementation, inherits the fix. The SPI documents that the argument arrives folded and must be used as given.

... (truncated)

Commits

9401898 chore(release): prepare 2.3.0
c252467 build(deps-dev): bump fast-uri and qs in the browser SDK
f013271 build(deps-dev): bump source-map-js to 1.2.2 in the browser SDK
d079c0c docs: style-guide follow-ups, SDK typecheck fix, and refreshed OG image
d1cc335 docs: add style guide and bring docs, Javadoc and site into conformance
54a087c refactor: architecture cleanup for readability and maintainability
70e3026 build(deps-dev): Bump the npm-dependencies group across 1 directory with 3 up...
2408099 build(deps): Bump the gh-actions group with 3 updates (#175)
1edab58 build(deps): Bump the dev-dependencies group with 13 updates (#176)
5a4695c build(deps): Bump brace-expansion in /clients/passkeys-browser (#173)
Additional commits viewable in compare view

Updates com.codeheadsystems:pk-auth-jwt from 2.2.0 to 2.3.0

Release notes

Sourced from com.codeheadsystems:pk-auth-jwt's releases.

Release 2.3.0

pk-auth 2.3.0

Maven Central

Add the modules you need (all share the same version):
implementation("com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0")
// or :pk-auth-dropwizard / :pk-auth-micronaut for the other adapters
implementation("com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0")
// testImplementation("com.codeheadsystems:pk-auth-testkit:2.3.0")
<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>pk-auth-spring-boot-starter</artifactId>
  <version>2.3.0</version>
</dependency>
Modules Published

com.codeheadsystems:pk-auth-core:2.3.0

com.codeheadsystems:pk-auth-jwt:2.3.0

com.codeheadsystems:pk-auth-admin-api:2.3.0

com.codeheadsystems:pk-auth-backup-codes:2.3.0

com.codeheadsystems:pk-auth-magic-link:2.3.0

com.codeheadsystems:pk-auth-otp:2.3.0

com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0

com.codeheadsystems:pk-auth-persistence-dynamodb:2.3.0

com.codeheadsystems:pk-auth-testkit:2.3.0

com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0

com.codeheadsystems:pk-auth-dropwizard:2.3.0

com.codeheadsystems:pk-auth-micronaut:2.3.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

chore: open 2.3.0 development line by @wolpert in codeheadsystems/pk-auth#105

v2.2.0 by @wolpert in codeheadsystems/pk-auth#106

build(deps): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in codeheadsystems/pk-auth#107

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#108

build(deps): Bump the dev-dependencies group with 4 updates by @dependabot[bot] in codeheadsystems/pk-auth#109

build(deps-dev): Bump @types/node from 26.0.1 to 26.1.0 in /clients/passkeys-browser in the npm-dependencies group across 1 directory by @dependabot[bot] in codeheadsystems/pk-auth#110

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#111

... (truncated)

Changelog

Sourced from com.codeheadsystems:pk-auth-jwt's changelog.

[2.3.0] - 2026-10-08

A security and maintainability release. The Security entries close findings from a full-project audit. The remaining entries come from an architecture review of the ceremony engine and the three adapters, a documentation style pass, and dependency updates.

Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), which changes username uniqueness semantics; the entry on JDBI username uniqueness below carries the details. Magic-link hosts that read SendResult.Sent.tokenJti move to the renamed jti component; the first Security entry carries the details.

Security

Magic-link SendResult.Sent no longer carries the login token. The record component was named tokenJti but held the complete signed magic-link JWT, a bearer credential that authenticates as the user without inbox access. A host logging or echoing what its name advertised as an opaque correlation id was publishing a working login credential. Sent now carries the real jti; the token reaches only the configured EmailSender. Breaking: the component is renamed tokenJti → jti and its value changes, so hosts that recovered the token from the result (e.g. to render their own email) must instead capture it in a MessageFormatter / EmailSender. startLogin's enumeration-resistant short-circuit paths continue to return Sent("").

Usernames are bounded and the in-memory rate-limiter caches can no longer grow without limit. Nothing capped username length (the JDBI column is Postgres TEXT), and both Caffeine caches used expireAfterWrite with no maximumSize. On the permitAll start endpoints, a caller varying its username grew the maps with its own key variety rather than with the number of real users, and every distinct key was retained for the full window. StartRegistrationRequest.MAX_USERNAME_LENGTH (256, enough for an email address) now bounds both start requests, and InMemoryCeremonyRateLimiter / InMemoryWindowCounter cap their maps at DEFAULT_MAX_TRACKED_KEYS (100 000). An over-long username is refused as a clean 400, covered by an adapter-level test asserting the refusal reaches the client as a 400 and not a 500. StartAuthenticationRequest still accepts a null username (the usernameless / discoverable-credential flow).

The per-username ceremony rate limit can no longer be bypassed by varying case. UserLookup implementations resolve usernames case-insensitively (DynamoDbUserLookup lower-cases the identity key), but the ceremony service passed the raw request string to CeremonyRateLimiter.tryAcquireForUsername, so alice, Alice, and ALICE drew on three independent budgets against one account, and an 8-character username yielded 256 of them. The per-IP bucket did not compensate: the per-username bucket exists for the distributed case, which is exactly the case the split defeated. The service now case-folds (toLowerCase(Locale.ROOT)) before consulting the limiter, so every CeremonyRateLimiter, including a host's shared Redis implementation, inherits the fix. The SPI documents that the argument arrives folded and must be used as given.

... (truncated)

Commits

9401898 chore(release): prepare 2.3.0
c252467 build(deps-dev): bump fast-uri and qs in the browser SDK
f013271 build(deps-dev): bump source-map-js to 1.2.2 in the browser SDK
d079c0c docs: style-guide follow-ups, SDK typecheck fix, and refreshed OG image
d1cc335 docs: add style guide and bring docs, Javadoc and site into conformance
54a087c refactor: architecture cleanup for readability and maintainability
70e3026 build(deps-dev): Bump the npm-dependencies group across 1 directory with 3 up...
2408099 build(deps): Bump the gh-actions group with 3 updates (#175)
1edab58 build(deps): Bump the dev-dependencies group with 13 updates (#176)
5a4695c build(deps): Bump brace-expansion in /clients/passkeys-browser (#173)
Additional commits viewable in compare view

Updates com.codeheadsystems:pk-auth-magic-link from 2.2.0 to 2.3.0

Release notes

Sourced from com.codeheadsystems:pk-auth-magic-link's releases.

Release 2.3.0

pk-auth 2.3.0

Maven Central

Add the modules you need (all share the same version):
implementation("com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0")
// or :pk-auth-dropwizard / :pk-auth-micronaut for the other adapters
implementation("com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0")
// testImplementation("com.codeheadsystems:pk-auth-testkit:2.3.0")
<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>pk-auth-spring-boot-starter</artifactId>
  <version>2.3.0</version>
</dependency>
Modules Published

com.codeheadsystems:pk-auth-core:2.3.0

com.codeheadsystems:pk-auth-jwt:2.3.0

com.codeheadsystems:pk-auth-admin-api:2.3.0

com.codeheadsystems:pk-auth-backup-codes:2.3.0

com.codeheadsystems:pk-auth-magic-link:2.3.0

com.codeheadsystems:pk-auth-otp:2.3.0

com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0

com.codeheadsystems:pk-auth-persistence-dynamodb:2.3.0

com.codeheadsystems:pk-auth-testkit:2.3.0

com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0

com.codeheadsystems:pk-auth-dropwizard:2.3.0

com.codeheadsystems:pk-auth-micronaut:2.3.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

chore: open 2.3.0 development line by @wolpert in codeheadsystems/pk-auth#105

v2.2.0 by @wolpert in codeheadsystems/pk-auth#106

build(deps): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in codeheadsystems/pk-auth#107

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#108

build(deps): Bump the dev-dependencies group with 4 updates by @dependabot[bot] in codeheadsystems/pk-auth#109

build(deps-dev): Bump @types/node from 26.0.1 to 26.1.0 in /clients/passkeys-browser in the npm-dependencies group across 1 directory by @dependabot[bot] in codeheadsystems/pk-auth#110

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#111

... (truncated)

Changelog

Sourced from com.codeheadsystems:pk-auth-magic-link's changelog.

[2.3.0] - 2026-10-08

A security and maintainability release. The Security entries close findings from a full-project audit. The remaining entries come from an architecture review of the ceremony engine and the three adapters, a documentation style pass, and dependency updates.

Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), which changes username uniqueness semantics; the entry on JDBI username uniqueness below carries the details. Magic-link hosts that read SendResult.Sent.tokenJti move to the renamed jti component; the first Security entry carries the details.

Security

Magic-link SendResult.Sent no longer carries the login token. The record component was named tokenJti but held the complete signed magic-link JWT, a bearer credential that authenticates as the user without inbox access. A host logging or echoing what its name advertised as an opaque correlation id was publishing a working login credential. Sent now carries the real jti; the token reaches only the configured EmailSender. Breaking: the component is renamed tokenJti → jti and its value changes, so hosts that recovered the token from the result (e.g. to render their own email) must instead capture it in a MessageFormatter / EmailSender. startLogin's enumeration-resistant short-circuit paths continue to return Sent("").

Usernames are bounded and the in-memory rate-limiter caches can no longer grow without limit. Nothing capped username length (the JDBI column is Postgres TEXT), and both Caffeine caches used expireAfterWrite with no maximumSize. On the permitAll start endpoints, a caller varying its username grew the maps with its own key variety rather than with the number of real users, and every distinct key was retained for the full window. StartRegistrationRequest.MAX_USERNAME_LENGTH (256, enough for an email address) now bounds both start requests, and InMemoryCeremonyRateLimiter / InMemoryWindowCounter cap their maps at DEFAULT_MAX_TRACKED_KEYS (100 000). An over-long username is refused as a clean 400, covered by an adapter-level test asserting the refusal reaches the client as a 400 and not a 500. StartAuthenticationRequest still accepts a null username (the usernameless / discoverable-credential flow).

The per-username ceremony rate limit can no longer be bypassed by varying case. UserLookup implementations resolve usernames case-insensitively (DynamoDbUserLookup lower-cases the identity key), but the ceremony service passed the raw request string to CeremonyRateLimiter.tryAcquireForUsername, so alice, Alice, and ALICE drew on three independent budgets against one account, and an 8-character username yielded 256 of them. The per-IP bucket did not compensate: the per-username bucket exists for the distributed case, which is exactly the case the split defeated. The service now case-folds (toLowerCase(Locale.ROOT)) before consulting the limiter, so every CeremonyRateLimiter, including a host's shared Redis implementation, inherits the fix. The SPI documents that the argument arrives folded and must be used as given.

... (truncated)

Commits

9401898 chore(release): prepare 2.3.0
c252467 build(deps-dev): bump fast-uri and qs in the browser SDK
f013271 build(deps-dev): bump source-map-js to 1.2.2 in the browser SDK
d079c0c docs: style-guide follow-ups, SDK typecheck fix, and refreshed OG image
d1cc335 docs: add style guide and bring docs, Javadoc and site into conformance
54a087c refactor: architecture cleanup for readability and maintainability
70e3026 build(deps-dev): Bump the npm-dependencies group across 1 directory with 3 up...
2408099 build(deps): Bump the gh-actions group with 3 updates (#175)
1edab58 build(deps): Bump the dev-dependencies group with 13 updates (#176)
5a4695c build(deps): Bump brace-expansion in /clients/passkeys-browser (#173)
Additional commits viewable in compare view

Updates com.codeheadsystems:pk-auth-otp from 2.2.0 to 2.3.0

Release notes

Sourced from com.codeheadsystems:pk-auth-otp's releases.

Release 2.3.0

pk-auth 2.3.0

Maven Central

Add the modules you need (all share the same version):
implementation("com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0")
// or :pk-auth-dropwizard / :pk-auth-micronaut for the other adapters
implementation("com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0")
// testImplementation("com.codeheadsystems:pk-auth-testkit:2.3.0")
<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>pk-auth-spring-boot-starter</artifactId>
  <version>2.3.0</version>
</dependency>
Modules Published

com.codeheadsystems:pk-auth-core:2.3.0

com.codeheadsystems:pk-auth-jwt:2.3.0

com.codeheadsystems:pk-auth-admin-api:2.3.0

com.codeheadsystems:pk-auth-backup-codes:2.3.0

com.codeheadsystems:pk-auth-magic-link:2.3.0

com.codeheadsystems:pk-auth-otp:2.3.0

com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0

com.codeheadsystems:pk-auth-persistence-dynamodb:2.3.0

com.codeheadsystems:pk-auth-testkit:2.3.0

com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0

com.codeheadsystems:pk-auth-dropwizard:2.3.0

com.codeheadsystems:pk-auth-micronaut:2.3.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

chore: open 2.3.0 development line by @wolpert in codeheadsystems/pk-auth#105

v2.2.0 by @wolpert in codeheadsystems/pk-auth#106

build(deps): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in codeheadsystems/pk-auth#107

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#108

build(deps): Bump the dev-dependencies group with 4 updates by @dependabot[bot] in codeheadsystems/pk-auth#109

build(deps-dev): Bump @types/node from 26.0.1 to 26.1.0 in /clients/passkeys-browser in the npm-dependencies group across 1 directory by @dependabot[bot] in codeheadsystems/pk-auth#110

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#111

... (truncated)

Changelog

Sourced from com.codeheadsystems:pk-auth-otp's changelog.

[2.3.0] - 2026-10-08

A security and maintainability release. The Security entries close findings from a full-project audit. The remaining entries come from an architecture review of the ceremony engine and the three adapters, a documentation style pass, and dependency updates.

Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), which changes username uniqueness semantics; the entry on JDBI username uniqueness below carries the details. Magic-link hosts that read SendResult.Sent.tokenJti move to the renamed jti component; the first Security entry carries the details.

Security

Magic-link SendResult.Sent no longer carries the login token. The record component was named tokenJti but held the complete signed magic-link JWT, a bearer credential that authenticates as the user without inbox access. A host logging or echoing what its name advertised as an opaque correlation id was publishing a working login credential. Sent now carries the real jti; the token reaches only the configured EmailSender. Breaking: the component is renamed tokenJti → jti and its value changes, so hosts that recovered the token from the result (e.g. to render their own email) must instead capture it in a MessageFormatter / EmailSender. startLogin's enumeration-resistant short-circuit paths continue to return Sent("").

Usernames are bounded and the in-memory rate-limiter caches can no longer grow without limit. Nothing capped username length (the JDBI column is Postgres TEXT), and both Caffeine caches used expireAfterWrite with no maximumSize. On the permitAll start endpoints, a caller varying its username grew the maps with its own key variety rather than with the number of real users, and every distinct key was retained for the full window. StartRegistrationRequest.MAX_USERNAME_LENGTH (256, enough for an email address) now bounds both start requests, and InMemoryCeremonyRateLimiter / InMemoryWindowCounter cap their maps at DEFAULT_MAX_TRACKED_KEYS (100 000). An over-long username is refused as a clean 400, covered by an adapter-level test asserting the refusal reaches the client as a 400 and not a 500. StartAuthenticationRequest still accepts a null username (the usernameless / discoverable-credential flow).

The per-username ceremony rate limit can no longer be bypassed by varying case. UserLookup implementations resolve usernames case-insensitively (DynamoDbUserLookup lower-cases the identity key), but the ceremony service passed the raw request string to CeremonyRateLimiter.tryAcquireForUsername, so alice, Alice, and ALICE drew on three independent budgets against one account, and an 8-character username yielded 256 of them. The per-IP bucket did not compensate: the per-username bucket exists for the distributed case, which is exactly the case the split defeated. The service now case-folds (toLowerCase(Locale.ROOT)) before consulting the limiter, so every CeremonyRateLimiter, including a host's shared Redis implementation, inherits the fix. The SPI documents that the argument arrives folded and must be used as given.

... (truncated)

Commits

9401898 chore(release): prepare 2.3.0
c252467 build(deps-dev): bump fast-uri and qs in the browser SDK
f013271 build(deps-dev): bump source-map-js to 1.2.2 in the browser SDK
d079c0c docs: style-guide follow-ups, SDK typecheck fix, and refreshed OG image
d1cc335 docs: add style guide and bring docs, Javadoc and site into conformance
54a087c refactor: architecture cleanup for readability and maintainability
70e3026 build(deps-dev): Bump the npm-dependencies group across 1 directory with 3 up...
2408099 build(deps): Bump the gh-actions group with 3 updates (#175)
1edab58 build(deps): Bump the dev-dependencies group with 13 updates (#176)
5a4695c build(deps): Bump brace-expansion in /clients/passkeys-browser (#173)
Additional commits viewable in compare view

Updates com.codeheadsystems:pk-auth-backup-codes from 2.2.0 to 2.3.0

Release notes

Sourced from com.codeheadsystems:pk-auth-backup-codes's releases.

Release 2.3.0

pk-auth 2.3.0

Maven Central

Add the modules you need (all share the same version):
implementation("com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0")
// or :pk-auth-dropwizard / :pk-auth-micronaut for the other adapters
implementation("com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0")
// testImplementation("com.codeheadsystems:pk-auth-testkit:2.3.0")
<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>pk-auth-spring-boot-starter</artifactId>
  <version>2.3.0</version>
</dependency>
Modules Published

com.codeheadsystems:pk-auth-core:2.3.0

com.codeheadsystems:pk-auth-jwt:2.3.0

com.codeheadsystems:pk-auth-admin-api:2.3.0

com.codeheadsystems:pk-auth-backup-codes:2.3.0

com.codeheadsystems:pk-auth-magic-link:2.3.0

com.codeheadsystems:pk-auth-otp:2.3.0

com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0

com.codeheadsystems:pk-auth-persistence-dynamodb:2.3.0

com.codeheadsystems:pk-auth-testkit:2.3.0

com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0

com.codeheadsystems:pk-auth-dropwizard:2.3.0

com.codeheadsystems:pk-auth-micronaut:2.3.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

chore: open 2.3.0 development line by @wolpert in codeheadsystems/pk-auth#105

v2.2.0 by @wolpert in codeheadsystems/pk-auth#106

build(deps): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in codeheadsystems/pk-auth#107

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#108

build(deps): Bump the dev-dependencies group with 4 updates by @dependabot[bot] in codeheadsystems/pk-auth#109

build(deps-dev): Bump @types/node from 26.0.1 to 26.1.0 in /clients/passkeys-browser in the npm-dependencies group across 1 directory by @dependabot[bot] in codeheadsystems/pk-auth#110

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#111

... (truncated)

Changelog

Sourced from com.codeheadsystems:pk-auth-backup-codes's changelog.

[2.3.0] - 2026-10-08

A security and maintainability release. The Security entries close findings from a full-project audit. The remaining entries come from an architecture review of the ceremony engine and the three adapters, a documentation style pass, and dependency updates.

Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), which changes username uniqueness semantics; the entry on JDBI username uniqueness below carries the details. Magic-link hosts that read SendResult.Sent.tokenJti move to the renamed jti component; the first Security entry carries the details.

Security

Magic-link SendResult.Sent no longer carries the login token. The record component was named tokenJti but held the complete signed magic-link JWT, a bearer credential that authenticates as the user without inbox access. A host logging or echoing what its name advertised as an opaque correlation id was publishing a working login credential. Sent now carries the real jti; the token reaches only the configured EmailSender. Breaking: the component is renamed tokenJti → jti and its value changes, so hosts that recovered the token from the result (e.g. to render their own email) must instead capture it in a MessageFormatter / EmailSender. startLogin's enumeration-resistant short-circuit paths continue to return Sent("").

Usernames are bounded and the in-memory rate-limiter caches can no longer grow without limit. Nothing capped username length (the JDBI column is Postgres TEXT), and both Caffeine caches used expireAfterWrite with no maximumSize. On the permitAll start endpoints, a caller varying its username grew the maps with its own key variety rather than with the number of real users, and every distinct key was retained for the full window. StartRegistrationRequest.MAX_USERNAME_LENGTH (256, enough for an email address) now bounds both start requests, and InMemoryCeremonyRateLimiter / InMemoryWindowCounter cap their maps at DEFAULT_MAX_TRACKED_KEYS (100 000). An over-long username is refused as a clean 400, covered by an adapter-level test asserting the refusal reaches the client as a 400 and not a 500. StartAuthenticationRequest still accepts a null username (the usernameless / discoverable-credential flow).

The per-username ceremony rate limit can no longer be bypassed by varying case. UserLookup implementations resolve usernames case-insensitively (DynamoDbUserLookup lower-cases the identity key), but the ceremony service passed the raw request string to CeremonyRateLimiter.tryAcquireForUsername, so alice, Alice, and ALICE drew on three independent budgets against one account, and an 8-character username yielded 256 of them. The per-IP bucket did not compensate: the per-username bucket exists for the distributed case, which is exactly the case the split defeated. The service now case-folds (toLowerCase(Locale.ROOT)) before consulting the limiter, so every CeremonyRateLimiter, including a host's shared Redis implementation, inherits the fix. The SPI documents that the argument arrives folded and must be used as given.

... (truncated)

Commits

9401898 chore(release): prepare 2.3.0
c252467 build(deps-dev): bump fast-uri and qs in the browser SDK
f013271 build(deps-dev): bump source-map-js to 1.2.2 in the browser SDK
d079c0c docs: style-guide follow-ups, SDK typecheck fix, and refreshed OG image
d1cc335 docs: add style guide and bring docs, Javadoc and site into conformance
54a087c refactor: architecture cleanup for readability and maintainability
70e3026 build(deps-dev): Bump the npm-dependencies group across 1 directory with 3 up...
2408099 build(deps): Bump the gh-actions group with 3 updates (#175)
1edab58 build(deps): Bump the dev-dependencies group with 13 updates (#176)
5a4695c build(deps): Bump brace-expansion in /clients/passkeys-browser (#173)
Additional commits viewable in compare view

Updates com.codeheadsystems:pk-auth-testkit from 2.2.0 to 2.3.0

Release notes

Sourced from com.codeheadsystems:pk-auth-testkit's releases.

Release 2.3.0

pk-auth 2.3.0

Maven Central

Add the modules you need (all share the same version):
implementation("com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0")
// or :pk-auth-dropwizard / :pk-auth-micronaut for the other adapters
implementation("com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0")
// testImplementation("com.codeheadsystems:pk-auth-testkit:2.3.0")
<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>pk-auth-spring-boot-starter</artifactId>
  <version>2.3.0</version>
</dependency>
Modules Published

com.codeheadsystems:pk-auth-core:2.3.0

com.codeheadsystems:pk-auth-jwt:2.3.0

com.codeheadsystems:pk-auth-admin-api:2.3.0

com.codeheadsystems:pk-auth-backup-codes:2.3.0

com.codeheadsystems:pk-auth-magic-link:2.3.0

com.codeheadsystems:pk-auth-otp:2.3.0

com.codeheadsystems:pk-auth-persistence-jdbi:2.3.0

com.codeheadsystems:pk-auth-persistence-dynamodb:2.3.0

com.codeheadsystems:pk-auth-testkit:2.3.0

com.codeheadsystems:pk-auth-spring-boot-starter:2.3.0

com.codeheadsystems:pk-auth-dropwizard:2.3.0

com.codeheadsystems:pk-auth-micronaut:2.3.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

chore: open 2.3.0 development line by @wolpert in codeheadsystems/pk-auth#105

v2.2.0 by @wolpert in codeheadsystems/pk-auth#106

build(deps): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in codeheadsystems/pk-auth#107

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#108

build(deps): Bump the dev-dependencies group with 4 updates by @dependabot[bot] in codeheadsystems/pk-auth#109

build(deps-dev): Bump @types/node from 26.0.1 to 26.1.0 in /clients/passkeys-browser in the npm-dependencies group across 1 directory by @dependabot[bot] in codeheadsystems/pk-auth#110

build(deps): Bump the dev-dependencies group with 5 updates by @dependabot[bot] in codeheadsystems/pk-auth#111

... (truncated)

Changelog

Sourced from com.codeheadsystems:pk-auth-testkit's changelog.

[2.3.0] - 2026-10-08

A security and maintainability release. The Security entries close findings from a full-project audit. The remaining entries come from an architecture review of the ceremony engine and the three adapters, a documentation style pass, and dependency updates.

Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), which changes username uniqueness semantics; the entry on JDBI username uniqueness below carries the details. Magic-link hosts that read SendResult.Sent.tokenJti move to the renamed jti component; the first Security entry carries the details.

Security

Magic-link SendResult.Sent no longer carries the login token. The record component was named tokenJti but held the complete signed magic-link JWT, a bearer credential that authenticates as the user without inbox access. A host logging or echoing what its name advertised as an opaque correlation id was publishing a working login credential. Sent now carries the real jti; the token reaches only the configured EmailSender. Breaking: the component is renamed tokenJti → jti and its value changes, so hosts that recovered the token from the result (e.g. to render their own email) must instead capture it in a MessageFormatter / EmailSender. startLogin's enumeration-resistant short-circuit paths continue to return Sent("").

Usernames are bounded and the in-memory rate-limiter caches can no longer grow without limit. Nothing capped username length (the JDBI column is Postgres TEXT), and both Caffeine caches used expireAfterWrite with no maximumSize. On the permitAll start endpoints, a caller varying its username grew the maps with its own key variety rather than with the number of real users, and every distinct key was retained for the full window. StartRegistrationRequest.MAX_USERNAME_LENGTH (256, enough for an email address) now bounds both start requests, and InMemoryCeremonyRateLimiter / InMemoryWindowCounter cap their maps at DEFAULT_MAX_TRACKED_KEYS (100 000). An over-long username is refused as a clean 400, covered by an adapter-level test asserting the refusal reaches the client as a 400 and not a 500. StartAuthenticationRequest still accepts a null username (the usernameless / discoverable-credential flow).

The per-username ceremony rate limit can no longer be bypassed by varying case. UserLookup implementations resolve usernames case-insensitively (DynamoDbUserLookup lower-cases the identity key), but the ceremony service passed the raw request string to CeremonyRateLimiter.tryAcquireForUsername, so alice, Alice, and ALICE drew on three independent budgets against one account, and an 8-character username yielded 256 of them. The per-IP bucket did not compensate: the per-username bucket exists for the distributed case, which is exactly the case the split defeated. The service now case-folds (toLowerCase(Locale.ROOT)) before consulting the limiter, so every CeremonyRateLimiter, including a host's shared Redis implementation, inherits the fix. The SPI documents that the argument arrives folded and must be used as given.

... (truncated)

Commits

9401898Description has been truncated

Bumps the gradle-minor-and-patch group with 7 updates: | Package | From | To | | --- | --- | --- | | [gradle-wrapper](https://github.com/gradle/gradle) | `9.8.0` | `9.8.1` | | [com.codeheadsystems:pk-auth-core](https://github.com/codeheadsystems/pk-auth) | `2.2.0` | `2.3.0` | | [com.codeheadsystems:pk-auth-jwt](https://github.com/codeheadsystems/pk-auth) | `2.2.0` | `2.3.0` | | [com.codeheadsystems:pk-auth-magic-link](https://github.com/codeheadsystems/pk-auth) | `2.2.0` | `2.3.0` | | [com.codeheadsystems:pk-auth-otp](https://github.com/codeheadsystems/pk-auth) | `2.2.0` | `2.3.0` | | [com.codeheadsystems:pk-auth-backup-codes](https://github.com/codeheadsystems/pk-auth) | `2.2.0` | `2.3.0` | | [com.codeheadsystems:pk-auth-testkit](https://github.com/codeheadsystems/pk-auth) | `2.2.0` | `2.3.0` | Updates `gradle-wrapper` from 9.8.0 to 9.8.1 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v9.8.0...v9.8.1) Updates `com.codeheadsystems:pk-auth-core` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-jwt` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-magic-link` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-otp` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-backup-codes` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-testkit` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-jwt` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-magic-link` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-otp` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-backup-codes` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) Updates `com.codeheadsystems:pk-auth-testkit` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/codeheadsystems/pk-auth/releases) - [Changelog](https://github.com/codeheadsystems/pk-auth/blob/main/CHANGELOG.md) - [Commits](codeheadsystems/pk-auth@v2.2.0...v2.3.0) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-core dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-jwt dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-magic-link dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-otp dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-backup-codes dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-testkit dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-jwt dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-magic-link dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-otp dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-backup-codes dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.codeheadsystems:pk-auth-testkit dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-15T11:54:19Z

Labels

The following labels could not be found: dependencies, gradle. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions Bot merged commit 915ee5a into main Oct 15, 2026
3 checks passed

github-actions Bot deleted the dependabot/gradle/gradle-minor-and-patch-5f337ea272 branch October 15, 2026 11:54

github-actions Bot approved these changes Oct 15, 2026

View reviewed changes

Navigation Menu

Repository navigation

build: bump the gradle-minor-and-patch group with 7 updates - #22

build: bump the gradle-minor-and-patch group with 7 updates#22
github-actions[bot] merged 1 commit into
mainfrom
dependabot/gradle/gradle-minor-and-patch-5f337ea272

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026

9.8.1

Upgrade instructions

Reporting problems

Release 2.3.0

pk-auth 2.3.0

Maven Central

Modules Published

What's Changed

What's Changed

[2.3.0] - 2026-10-08

Security

Release 2.3.0

pk-auth 2.3.0

Maven Central

Modules Published

What's Changed

What's Changed

[2.3.0] - 2026-10-08

Security

Release 2.3.0

pk-auth 2.3.0

Maven Central

Modules Published

What's Changed

What's Changed

[2.3.0] - 2026-10-08

Security

Release 2.3.0

pk-auth 2.3.0

Maven Central

Modules Published

What's Changed

What's Changed

[2.3.0] - 2026-10-08

Security

Release 2.3.0

pk-auth 2.3.0

Maven Central

Modules Published

What's Changed

What's Changed

[2.3.0] - 2026-10-08

Security

Release 2.3.0

pk-auth 2.3.0

Maven Central

Modules Published

What's Changed

What's Changed

[2.3.0] - 2026-10-08

Security

Uh oh!

dependabot Bot commented on behalf of github Oct 15, 2026

Labels

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants