Skip to content

CHANGELOG.md

Latest commit

 

History

History
117 lines (73 loc) · 6.97 KB

CHANGELOG.md

File metadata and controls

117 lines (73 loc) · 6.97 KB
Raw

2.4.2 (2026-07-28)

Security

  • deps: upgrade axios ^1.6.2 → ^1.18.1 — remediates CVE-2026-44492 (SSRF) and CVE-2026-44487 (Proxy-Authorization leak) plus three further axios CVEs
  • deps: remove pm2 from production dependencies — pm2 is installed globally in the container image; the unused package entry carried a CVE column (ip SSRF, systeminformation, ws@7.4.6, bundled axios@0.21.4)
  • deps: override jws to ^3.2.3 — resolves the HMAC verification advisory (GHSA-869p-cjfg-cm3x / CVE-2025-65945) on the vulnerable jws versions pulled in transitively by jsonwebtoken

Chores

  • deps: bump @types/node to ^22.0.0 (Node 22 LTS) and drop skipLibCheck — resolves the axios type incompatibility at the root rather than suppressing declaration-file type checking globally

2.4.1 (2026-07-27)

Bug Fixes

  • transport: include sessionContext (access token) in the WebSocket broadcast payload to MAG
    • Without it MAG rejects the frame, so sign responses never reach Fireblocks and transactions sit in PENDING_SIGNATURE indefinitely
    • Affects every 2.4.0 deployment using WebSocket delivery — i.e. the default — so upgrading is required
    • Added coverage for broadcastResponse access-token resolution failures

Features

  • examples: Thales Luna Network HSM support for the example customer server
    • New Dockerfile.luna — Ubuntu 22.04 image bundling the Luna client (libCryptoki2_64.so, lunacm, vtl). The proprietary vendor tarball is never committed; supply it at build time in the gitignored examples/server/luna/. linux/amd64 only
    • New luna-entrypoint.sh — idempotent client registration against the appliance plus vtl verify at startup; skipped entirely when LUNA_HOST is unset, so the same image still runs in SoftHSM mode
    • PKCS#11 facade parameterized via HSM_MODULE / HSM_PIN / HSM_SLOT_LABEL, making HSM provider selection runtime configuration rather than a code change
    • Signing resilience for Luna sessions
  • examples: example customer server base image migrated Alpine → Ubuntu 22.04 (glibc, required by the Luna client)

2.4.0 (2026-07-22)

Features

  • transport: WebSocket push delivery, default-on (opt out with WEBSOCKET_ENABLED=false)
    • Agent receives messages via MAG's /msg/ws WebSocket endpoint instead of HTTP long-polling
    • Message acks ride the socket; sign responses continue to use HTTP
    • Three-layer liveness: handshake watchdog, app-level ping/keep-alive, TCP SO_KEEPALIVE
    • Exponential backoff with jitter on reconnect; fresh access token fetched per attempt
  • resilience: process-level unhandledRejection and uncaughtException handlers
  • examples: cluster mode for the example customer server — nginx load balancer in front of a pool of signer replicas; see docs/cluster-setup-guide.md

1.7.0 (2023-12-21)

Features

  • docker: wip- prepare installation (e4ab3a8)
  • installation: wip (4a2865b)

1.6.0 (2023-12-20)

Features

  • verify: verify metadata and encodedMessage with zService and policy service (075a715)
  • verify: verify metadata and zService jwt (d0d036e)

1.5.0 (2023-12-18)

Features

  • integration: wip starting to connect the dots (1455e81)

1.4.0 (2023-12-18)

Features

  • example server: support multi algorithms (45a1fb7)

1.3.0 (2023-12-17)

Features

  • customer server: randomly sign or reject transactions (bd76297)

1.2.0 (2023-12-12)

Features

  • example server: add pem public key to generateKeyPair (a07c402)

1.1.0 (2023-12-11)

Features

  • customer server: add softHsm (cf0b386)

1.0.0 (2023-12-07)

Features

  • accessToken: get access token in loop (b3398b2)
  • agent: pair flow (98ab453)
  • build: try to add to CI (eba0c49)
  • ci: fix build (25ef0c1)
  • CI: integrating w/ CI (2807319)
  • customer server client: add customer server client + example server imple (5b0f380)
  • customerServer: hsm <> customer server communication (9cacf92)
  • env: add support for dev env (8038819)
  • loop: wip add handle message logic (cdd3813)
  • main loop: pull messages (c8b5683)
  • messageService: closed the loop from getting a message through sending it to customer server (37aa62b)
  • pair: working pair flow (c10ccee)