Release Notes

Each security-for-flow milestone ships with a dedicated release-notes document covering scope, new SPIs, breaking changes, and mutation-coverage numbers. The latest published release on Maven Central is 00.79.41.

00.79.41 — Latest

Security-hardening tick: 21 findings closed (1 Medium, 16 Low, 3 Info) — GitHub identity anchored to the immutable account id, the OIDC nonce/CSRF defence made reachable through the API, annotation inheritance across class hierarchies, and three new shared homes against consistency drift. Additive.

00.79.40

Security-hardening tick: 10 findings closed plus opt-in deny-by-default authorization (JS-SEC-024, backward-compatible, off by default). A second workflow-backed exit review found and fixed 10 further interaction findings. Additive.

00.79.30

Security-hardening tick: all 28 findings of the 2026-07-02 source-review audit closed (0 Critical, 0 High). Secure-by-default session rotation, fail-closed empty-constraint evaluators, JWT/OIDC/DPoP spec-fidelity fixes, corrected JavaDoc guarantees. Additive.

00.79.20

OAuth2 deep-hardening (Etappe 3, final): JWE decoding (RFC 7516), mTLS (RFC 8705), PAR (RFC 9126), JAR (RFC 9101), the FIPS profile and the demo pass — completing the 00.76→00.79 identity trilogy. Additive.

00.79.10

Token-Binding + Logout-Hardening (Etappe 2): replay-protection stores (JtiStore / NonceStore), DPoP sender-constrained tokens (RFC 9449, new jSentinel-dpop) and OIDC back-/front-channel logout hardening. Additive.

00.79.00

Identity Interop + Stable-API: the coordinated stable-API promotion of the JWT / OAuth2 / OIDC surfaces (47 types), six IdP vendor profiles (Keycloak, Entra, Auth0, Okta, Google, GitHub) and a no-mock OIDC test harness. Additive.

00.78.00

OpenID Connect Relying-Party: ID-token validation (nonce / azp / at_hash / acr step-up), discovery, UserInfo, RP-initiated logout and claims-to-subject mapping — wired through .oidc(...). Three new modules on the 00.77 OAuth2 base; additive.

00.77.00

OAuth2 Relying-Party flows: Authorization-Code + PKCE (S256-only), client auth incl. private_key_jwt, refresh-token rotation with reuse-detection, introspection, revocation and the Device Authorization Grant — wired through .oauth2(...). Three new modules on the jSentinel-jwt base; additive.

00.76.10

Security-hardening tick: a full review of all 25 library modules (14 findings fixed in-cycle, no critical / no auth-bypass), the SpotBugs / FindSecBugs gate hoisted reactor-wide, all 46 Dependabot alerts closed, optional typ-header validation (RFC 8725), and two PRODUCTION fail-fast hardenings. Additive.

00.76.00

Standardized JWT validation: a new opt-in jSentinel-jwt module (Nimbus) with a JOSE-free JwtValidator SPI, a disciplined JWKS client, a mandatory algorithm allow-list with hard algorithm-confusion defence, and a .jwt(...) bootstrap across all three adapters. Additive; the base for OAuth2 / OIDC.

00.75.20

Production-review hardening tick #2: 39 findings (R006–R044) closed — secret-leak redaction, concurrency races, fail-closed @SecureRoute, OWASP-minimum KDF floors, adapter consistency and SLF4J migration. Additive; no new feature or module.

00.75.10

Core hardening + a SpotBugs / FindSecBugs static-analysis gate: type-safe TokenHasher, hardened JSON parsers, an instantiable JSentinelContext, and four urgent event-bus / Eclipse-Store fixes. Additive; no new module.

00.75.00

The Security Event Bus: ~34 typed JSentinelEvent records in signed (Ed25519) envelopes with replay protection, per-(tenant, producer) sequencing, producer policy, Eclipse-Store-backed stores and a REST/SSE bridge. Audit becomes a consumer. Four new modules; purely additive.

00.74.20

Storage-Pair architecture: JSentinelStorageFactory.openAt(...) returns a JSentinelStoragePair that opens framework + app Eclipse-Store under one parent dir with one two-phase shutdown. Plus the HealthView admin demo, currentRuntime() accessor, a BouncyCastle bump and the javadoc-jar fix. Additive, no new module.

00.74.10

Maintenance + DX tooling: a JSentinelRuntime tooling API (summary / toMap / toJson / healthCheck) for /health endpoints, plus framework-feedback fixes (InternalError cause, audit-sink WARN logs, PasswordPolicy.minLength()). Additive, no new module.

00.74.00

Declarative token propagation: @PropagateToken, TokenCredentialStore SPI, pluggable OutboundTokenStrategy (pass-through / token-exchange / client-credentials), and a .propagation(...) sub-builder. Three new modules; additive over 00.73.

00.73.00

The jSentinel rebrand: Maven coordinates → com.svenruppert.jsentinel, artifacts → jSentinel-*, packages → com.svenruppert.jsentinel.*, and the Security* service types → JSentinel*. First release under the jSentinel name — plus the fluent-bootstrap completion.

00.72.00

Developer-experience release: typed fluent bootstrap (VaadinSecurity / RestSecurity / StandaloneSecurity), dependency-free @SecurityAutoService processor, Vaadin starter (@SecureRoute + SecuredUi), secret-free diagnostics. 22 modules. No new security primitives.

00.71.00

Credential-security stack (ships in the 00.72 line): JDK-only PBKDF2 core, optional Argon2id / bcrypt / scrypt, post-KDF HMAC pepper, compare-and-swap CredentialStore, atomic password change, single-use reset, breached-password checks (HIBP), abuse detection, ASVS / NIST / CWE traceability.

00.70.00

2026-05-31 · Konzept-V00.70 closed: multi-tenancy, 11 persistence-store SPIs + Eclipse Store reference, SecurityVersion drift detection, Policy API, @Secured method-security processor, role hierarchy, account lifecycle, API keys, rate limiting, Phase-8 Vaadin components.

00.60.00

2026-05-14 · Konzept-V00.60 closed: audit / brute-force / session / action SPIs stable, fourth adapter security-standalone, Vaadin Browserless tests, mutation push across the reactor.

00.51.00

2026-05-08 · Multi-module split: security-core / security-vaadin / security-rest, REST adapter, two-tier demo demo-vaadin-rest-client, first-run bootstrap, central LogoutService.

Versioning policy

The project uses MM.mm.pp numeric versions (e.g. 00.60.00, 00.51.00). The leading double-zero is intentional — it documents the pre-1.0 phase of public consumption. SPIs are stable in the sense declared per release; experimental ones are marked @ExperimentalJSentinelApi.

Maven coordinates always carry the full triplet, e.g.:

<dependency>
  <groupId>com.svenruppert.jsentinel</groupId>
  <artifactId>jSentinel-core</artifactId>
  <version>00.79.41</version>
</dependency>