From 40c8180c8f347e2bc3e9c9407a09d9031f1f64e4 Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Thu, 8 Oct 2026 07:01:29 -0700 Subject: [PATCH] chore(release): prepare 2.3.0 Move the [Unreleased] security entries under [2.3.0] - 2026-10-08 and add the architecture-review fixes, refactors, documentation work, and browser SDK dependency updates merged since v2.2.0. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 81 ++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 75 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 63cf36e..736e4ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,12 +11,18 @@ the source. ## [Unreleased] -A security release driven by a full-project audit. Every entry below closes a -finding from that review. +## [2.3.0] - 2026-10-08 -JDBI hosts pick up one new Flyway migration (V12), which changes username -uniqueness semantics. The entry on JDBI username uniqueness below carries the -upgrade note. +A security and maintainability release. The Security entries close findings +from a full-project audit. The remaining entries come from an architecture +review of the ceremony engine and the three adapters, a documentation style +pass, and dependency updates. + +Two upgrade notes apply. JDBI hosts pick up one new Flyway migration (V12), +which changes username uniqueness semantics; the entry on JDBI username +uniqueness below carries the details. Magic-link hosts that read +`SendResult.Sent.tokenJti` move to the renamed `jti` component; the first +Security entry carries the details. ### Security @@ -82,6 +88,68 @@ upgrade note. `AdminResult.ValidationFailed`, a clean `400`, never a thrown exception across the sealed result boundary. The bound is checked before the challenge preflight, so a rejected label does not burn the single-use challenge. +- Browser SDK development dependencies are updated to patched versions: + `source-map-js` 1.2.2 (GHSA-68fv-2mgg-jv7q, high), `fast-uri` 3.1.8 + (GHSA-hrr3-gc8f-f4qj), and `qs` 6.16.0 (GHSA-x5fp-wj9c-mxmx, + GHSA-4mjr-xmp4-gh2g). All three are transitive build and test tooling; the + published SDK has no runtime dependencies. + +### Added + +- `pk-auth-core` exports `com.codeheadsystems.pkauth.ratelimit`, and + `pk-auth-jwt` exports `com.codeheadsystems.pkauth.composition`. Both packages + were already public and used by other published modules (`InMemoryWindowCounter` + by backup-codes and magic-link, `PkAuthComposition` by all three adapters); the + exports make them reachable on the module path. +- Dropwizard: `PkAuthCeremonyGraph`, a shared parent interface of + `PkAuthComponent` and `PkAuthFullComponent` that holds their common provision + methods. Existing callers of either component are unaffected. +- `docs/style.md`, the documentation style guide that every Markdown file, + Javadoc comment, and the site follow. + +### Changed + +- `DefaultPasskeyAuthenticationService` is restructured internally: exhaustive + switches over the sealed challenge-validation result replace a hand-written + visitor, one metrics emitter replaces three copies, exception mapping for + registration and authentication share one shape, private sealed types replace + nullable sentinels, and challenge issuance is shared by both start methods. + Metric names, tag values, and result mappings are unchanged. +- `InMemoryCeremonyRateLimiter` delegates to two `InMemoryWindowCounter` + instances instead of duplicating their logic, and `RefreshTtlPolicy` delegates + to `TokenTtlPolicy`. Behaviour is unchanged. +- Dropwizard builds a single `RefreshTokenService` instance shared by the + refresh endpoint and the user-deletion listener (previously two), and every + adapter subpackage is `@NullMarked`. `PkAuthBundle.jwtIssuer()` and + `jwtValidator()` called before `run()` still throw `IllegalStateException`, + now with the message "PkAuthBundle.run has not been invoked yet". +- Documentation: DESIGN.md, the operator guide, GETTING_STARTED, and + `docs/stability.md` are corrected where they had drifted from the code (JWT + claims, `JwtVerificationResult` variants, the DynamoDB `ttl` attribute, + coverage gates, host-run migrations, the Dropwizard wiring example). All + documentation, Javadoc, and the site follow the new style guide; ADR titles + are rewritten as noun phrases; and the original build brief moves to + `docs/history/`. +- `SECURITY.md` names `2.x` as the supported line; `1.x` is no longer + supported. + +### Fixed + +- A registration that loses a race on `CredentialRepository.save` returns + `RegistrationResult.DuplicateCredential` (`409`). Previously the repository's + `DuplicateCredentialException` escaped the sealed-result boundary and adapters + answered `503 persistence_failure`. +- Malformed extension CBOR in assertion authenticator data returns + `AssertionResult.InvalidChallenge` (`400`) instead of an uncaught exception + (`500`). A corrupt stored COSE key still propagates as a server fault. +- `CeremonyWireMapper.CeremonyResponse` preserves body and header insertion + order. `Map.copyOf` had discarded it, so ceremony JSON field order varied + between JVM runs. +- Spring: a host-supplied `PkAuthCeremonyController` bean replaces the default. + An unconditional `@Import` had registered the default alongside it, which + produced duplicate request mappings. +- Browser SDK: `npm run typecheck`, and therefore `prepublishOnly`, failed on a + test import from a nonexistent `../dist/src` path. ## [2.2.0] - 2026-06-27 @@ -560,7 +628,8 @@ Security-review follow-ups (hardening; no known exploit in the items below). First stable release. Captures the surface produced by the 0.x development series; see `git log` for the full history. -[Unreleased]: https://github.com/codeheadsystems/pk-auth/compare/v2.2.0...HEAD +[Unreleased]: https://github.com/codeheadsystems/pk-auth/compare/v2.3.0...HEAD +[2.3.0]: https://github.com/codeheadsystems/pk-auth/compare/v2.2.0...v2.3.0 [2.2.0]: https://github.com/codeheadsystems/pk-auth/compare/v2.1.0...v2.2.0 [2.1.0]: https://github.com/codeheadsystems/pk-auth/compare/v2.0.0...v2.1.0 [2.0.0]: https://github.com/codeheadsystems/pk-auth/compare/v1.3.1...v2.0.0