Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Release Notes
00.75.20

00.75.20

Available on Maven Central. The second hardening tick on the 00.75 line, after 00.75.10, and the last station before the JWT / OAuth2 / OIDC arc — which opens with 00.76.00 (standardized JWT validation); the current release is 00.79.41. No new feature, no new module — 39 production-review findings closed, each with a bug-catching test (real impls, no mocks).

Release date: 2026-06-25 Previous release: 00.75.10 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.75.20 Full changelog: GitHub release v00.75.20

It works the remaining open findings of the 2026-06-24 production review (R006–R044) that 00.75.10 did not already close — correctness, security and consistency fixes, risk-first.

Highlights

  • Secret-leak redaction (High) — BootstrapToken.toString() masks the one-time admin secret; LoggingNotificationSender redacts token/secret/password attributes (CWE-532); the Vaadin Forbidden reason no longer reaches the user-facing error view.
  • Concurrency races (High) — atomic sequence reservation in PublishPipeline; InMemoryReplayStore evicts soonest-to-expire (not by recency, which allowed in-window replay); InMemoryPepperService and InMemoryAbuseDetectionService made race-safe.
  • DoS guards (High) — CanonicalJson nesting-depth limit (StackOverflow); Argon2id/scrypt verify() clamps memory/N parsed from the envelope.
  • AuthZ consistency — subject id from the registered SubjectIdResolver (not user.toString()); wildcard-aware PermissionMatcher in the action layer; per-adapter AuthorizationDecision mapping documented and pinned; REST adapter uses the HttpStatus enum (no magic numbers).
  • REST / OIDC / CORS — null-safe, locale-stable operation derivation; CORS wildcard-origin + allowCredentials(true) flagged; OIDC strategies stop leaking the token-endpoint body; token-exchange cache key hashed, never the raw bearer.
  • Standalone / processor / DX — SecuredProxy handles equals/hashCode/toString by proxy identity; processors fail on conflicting annotations / write-once Filer merge; idempotent Eclipse-Store close().

Deliberate hardening (behaviour changes)

  • @SecureRoute() with no constraints now denies anonymous access — it means “any authenticated subject”, never “anyone”.
  • KDF floors raised to OWASP minimums — scrypt default N 2¹⁵ → 2¹⁷; below-floor stored hashes rehash on the next successful verify.
  • Audit / notification logging moved to named SLF4J loggers (com.svenruppert.jsentinel.audit / .accountlifecycle) instead of java.util.logging — route them to a dedicated appender if desired.
  • DX rateLimit / apiKeys / refreshTokens no longer appear as registered services; they surface as INFO and remain readable from BootstrapState.

Quality

PIT was re-measured over every touched module; acceptance was “no module more than 3 % below its baseline”. The tick is test-additive, so coverage is stable-or-up across the board (jSentinel-core 86 %, -rest 95 %, -standalone 98 %, -events 85 %, -dx 71 %). Two modules dip 3 pp at the threshold — pure denominator effects where a new branch needs a real adapter runtime to exercise. Full-reactor clean install green across all 40 modules; -Pstatic-analysis SpotBugs gate green. No mocks.

Migration

None beyond the deliberate hardening above. Just bump the version to 00.75.20.

00.75.1000.76.00