Skip to content

Commit 0854cf7

Browse files
adamwalachgithub-actions[bot]
adamwalach
authored and
github-actions[bot]
committed
chore(docs): update of OEL changelog
1 parent 9ac94e6 commit 0854cf7

5 files changed

Lines changed: 110 additions & 0 deletions

File tree

‎docs/self-hosted/oel/keto/changelog/v26.2.9.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## v26.2.9
2+
3+
### Patch security vulnerabilities in dependencies
4+
5+
Bump several dependencies to patched versions to address security advisories reported by Dependabot.
6+
7+
Notable updates:
8+
9+
- `github.com/jackc/pgx/v5` to `v5.9.2` across all Go modules (SQL injection via placeholder confusion in dollar-quoted string
10+
literals).
11+
- `github.com/moby/spdystream` to `v0.5.1` (denial of service on container runtime interface).
12+
- `go.opentelemetry.io/otel` to `v1.41.0` (remote DoS amplification via multi-value baggage header).
13+
- `postcss` to `>=8.5.10` (XSS via unescaped `</style>` in CSS stringify output).
14+
- `uuid` to `>=14.0.0` (missing buffer bounds check in v3/v5/v6 generators).
15+
- `@xmldom/xmldom` to `>=0.8.13` (XML node injection and uncontrolled recursion).
16+
- `axios`, `follow-redirects`, `lodash`, `picomatch`, `brace-expansion`, `serialize-javascript`, `yaml`, `file-type`,
17+
`i18next-fs-backend`, `@nestjs/core` to their respective patched versions.

‎docs/self-hosted/oel/kratos/changelog/v26.2.9.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## v26.2.9
2+
3+
### Harden identity-schema loading against denial-of-service
4+
5+
Adds a structural pre-parse gate to identity-schema loading. Before a customer-supplied schema reaches the upstream JSON Schema
6+
compiler, kratos now rejects schemas that exceed any of the following limits:
7+
8+
- 1 MiB body size on the fetched schema document.
9+
- 32 levels of nested objects or arrays.
10+
- 1024 keys per object (`properties`, `patternProperties`, `$defs`, etc.).
11+
- 128 elements per array (`allOf`, `anyOf`, `oneOf`, tuple `items`, etc.).
12+
- 8192 total nodes across the schema tree.
13+
14+
The same pass also rejects `$ref` values that resolve to the document root (`#`, `#/`, or empty) — these produce a
15+
self-referential pointer in the compiled schema and would otherwise crash the kratos process via fatal stack overflow at validate
16+
time. Invalid regular expressions in `pattern` and `patternProperties` keys are now caught up front, instead of panicking deep in
17+
the upstream compiler.
18+
19+
When kratos fetches a schema URL outside of an HTTP request context (for example from a background task), the loader now attaches
20+
an SSRF-guarded HTTP client by default. Request paths that already attach a configured client via the request middleware are
21+
unaffected.
22+
23+
The Ory Network HTTP cache for identity schemas now caps response bodies at the same 1 MiB limit and refuses to cache anything
24+
larger.
25+
26+
Existing identity schemas at realistic sizes (well under all limits) are unaffected.
27+
28+
### Patch security vulnerabilities in dependencies
29+
30+
Bump several dependencies to patched versions to address security advisories reported by Dependabot.
31+
32+
Notable updates:
33+
34+
- `github.com/jackc/pgx/v5` to `v5.9.2` across all Go modules (SQL injection via placeholder confusion in dollar-quoted string
35+
literals).
36+
- `github.com/moby/spdystream` to `v0.5.1` (denial of service on container runtime interface).
37+
- `go.opentelemetry.io/otel` to `v1.41.0` (remote DoS amplification via multi-value baggage header).
38+
- `postcss` to `>=8.5.10` (XSS via unescaped `</style>` in CSS stringify output).
39+
- `uuid` to `>=14.0.0` (missing buffer bounds check in v3/v5/v6 generators).
40+
- `@xmldom/xmldom` to `>=0.8.13` (XML node injection and uncontrolled recursion).
41+
- `axios`, `follow-redirects`, `lodash`, `picomatch`, `brace-expansion`, `serialize-javascript`, `yaml`, `file-type`,
42+
`i18next-fs-backend`, `@nestjs/core` to their respective patched versions.

‎docs/self-hosted/oel/oathkeeper/changelog/v26.2.9.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## v26.2.9
2+
3+
### Patch security vulnerabilities in dependencies
4+
5+
Bump several dependencies to patched versions to address security advisories reported by Dependabot.
6+
7+
Notable updates:
8+
9+
- `github.com/jackc/pgx/v5` to `v5.9.2` across all Go modules (SQL injection via placeholder confusion in dollar-quoted string
10+
literals).
11+
- `github.com/moby/spdystream` to `v0.5.1` (denial of service on container runtime interface).
12+
- `go.opentelemetry.io/otel` to `v1.41.0` (remote DoS amplification via multi-value baggage header).
13+
- `postcss` to `>=8.5.10` (XSS via unescaped `</style>` in CSS stringify output).
14+
- `uuid` to `>=14.0.0` (missing buffer bounds check in v3/v5/v6 generators).
15+
- `@xmldom/xmldom` to `>=0.8.13` (XML node injection and uncontrolled recursion).
16+
- `axios`, `follow-redirects`, `lodash`, `picomatch`, `brace-expansion`, `serialize-javascript`, `yaml`, `file-type`,
17+
`i18next-fs-backend`, `@nestjs/core` to their respective patched versions.

‎docs/self-hosted/oel/oauth2/changelog/v26.2.9.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## v26.2.9
2+
3+
### Patch security vulnerabilities in dependencies
4+
5+
Bump several dependencies to patched versions to address security advisories reported by Dependabot.
6+
7+
Notable updates:
8+
9+
- `github.com/jackc/pgx/v5` to `v5.9.2` across all Go modules (SQL injection via placeholder confusion in dollar-quoted string
10+
literals).
11+
- `github.com/moby/spdystream` to `v0.5.1` (denial of service on container runtime interface).
12+
- `go.opentelemetry.io/otel` to `v1.41.0` (remote DoS amplification via multi-value baggage header).
13+
- `postcss` to `>=8.5.10` (XSS via unescaped `</style>` in CSS stringify output).
14+
- `uuid` to `>=14.0.0` (missing buffer bounds check in v3/v5/v6 generators).
15+
- `@xmldom/xmldom` to `>=0.8.13` (XML node injection and uncontrolled recursion).
16+
- `axios`, `follow-redirects`, `lodash`, `picomatch`, `brace-expansion`, `serialize-javascript`, `yaml`, `file-type`,
17+
`i18next-fs-backend`, `@nestjs/core` to their respective patched versions.

‎docs/self-hosted/oel/polis/changelog/v26.2.9.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## v26.2.9
2+
3+
### Patch security vulnerabilities in dependencies
4+
5+
Bump several dependencies to patched versions to address security advisories reported by Dependabot.
6+
7+
Notable updates:
8+
9+
- `github.com/jackc/pgx/v5` to `v5.9.2` across all Go modules (SQL injection via placeholder confusion in dollar-quoted string
10+
literals).
11+
- `github.com/moby/spdystream` to `v0.5.1` (denial of service on container runtime interface).
12+
- `go.opentelemetry.io/otel` to `v1.41.0` (remote DoS amplification via multi-value baggage header).
13+
- `postcss` to `>=8.5.10` (XSS via unescaped `</style>` in CSS stringify output).
14+
- `uuid` to `>=14.0.0` (missing buffer bounds check in v3/v5/v6 generators).
15+
- `@xmldom/xmldom` to `>=0.8.13` (XML node injection and uncontrolled recursion).
16+
- `axios`, `follow-redirects`, `lodash`, `picomatch`, `brace-expansion`, `serialize-javascript`, `yaml`, `file-type`,
17+
`i18next-fs-backend`, `@nestjs/core` to their respective patched versions.

0 commit comments

Comments
 (0)