Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Release Notes
00.76.10

00.76.10

Available on Maven Central. A security-hardening tick on the 00.76 line, after 00.76.00 (JWT validation) and before the federation arc — which opens with the current release 00.79.41 (OAuth2 RP flows). No new feature, no new module, no new SPI. Additive — the only signature change is to an @ExperimentalJSentinelApi type.

Release date: 2026-06-26 Previous release: 00.76.00 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.76.10 Full changelog: GitHub release v00.76.10

It consolidates the security and robustness quality of the entire library surface before the federation releases build on it.

Headline — full security review of all 25 library modules

A systematic, evidence-based audit of every src/main/java class in the 25 library modules (demos excluded). No critical finding, no auth-bypass, no Java deserialization of untrusted data. Fourteen findings fixed in-cycle — nothing carried to a backlog:

  • R10 (High) — HttpJwksClient.findKey threw NPE on a kid-less JWS during the negative-cache window (a request-path DoS); null-kid guard returns empty per contract.
  • R11 (Medium) — a non-https JWKS URI (the JWT trust root over cleartext) is now an ERROR in PRODUCTION (was only a warning); dev modes keep INFO for loopback http.
  • R13 (Medium) — standalone thread-propagation rebound the subject under the wrong type key — the feature was silently dead; now resolves the real subjectType().
  • R14 (Medium) — post-login rotation audit leaked subject.toString() (email/hash) as the subject id; now derived via SubjectIdResolver.
  • R15 (Medium) — credentialed-wildcard CORS (Allow-Credentials: true + Origin: *) is no longer published in PRODUCTION (CORS left unconfigured — the safe default).
  • R16 (Medium) — consume-side event sequence validation had a read-decide-commit race; new atomic compareAndAdvance CAS.
  • R07 / R08 / R09 / R12 — dead-letter markResolved drops the heavy envelope; InMemoryReplayStore eviction is now O(log n) expiry-ordered; JsonResponse token extraction is a depth-aware top-level-only scanner; the HIBP lookup gets a 1 MiB body cap + Redirect.NEVER.
  • R06 — three process-global holders now reject a conflicting second publish loudly (equal re-publish stays idempotent).
  • R17 / R18 / R19 — propagation wrapper generator renders type-variable params / varargs correctly; the @JSentinelAutoService processor retains prior entries under incremental compile.

Every fix ships with a no-mock test (real JDK HttpServer JWKS/HIBP stubs, real Nimbus issuers, in-process processor compilation, real concurrency tests).

Reactor-wide static-analysis gate

The -Pstatic-analysis gate (SpotBugs 4.9.8.3 + FindSecBugs 1.13.0, effort=Max, threshold=Medium, fail-on-error) was hoisted from five per-module poms into jSentinel-parent — every library module, present and future, inherits it automatically (closing the drift where a new module could ship ungated). All 25 library modules are green.

Dependency security

All 46 open Dependabot alerts (14 high / 32 moderate) closed — reduced to two Jackson pins: jackson-databind 2.18.0 → 2.20.2 (jSentinel-dx, test scope — the runtime classpath stays JSON-library-free) and the demo-Vaadin Jackson 3.x 3.1.2 → 3.1.4. nimbus-jose-jwt 10.3.1 (new in 00.76) has no open alert.

Experimental API change & additions

  • JwksRefreshResult.error → errorClass (@ExperimentalJSentinelApi) — no longer a live Optional<Throwable> a logger could print with full endpoint/stack detail; now a short, non-secret Optional<String> descriptor. Only consumer is the in-tree HttpJwksClient.
  • Optional typ-header validation (RFC 8725 §3.11) — additive ClaimExpectations.expectedTyp; when set, NimbusJwtValidator rejects a token whose typ is absent/mismatched (claims/typ-mismatch). Bootstrap: .jwt(j -> j.tokenType("at+jwt")). Default behaviour unchanged.

PRODUCTION-mode behaviour changes

Two PRODUCTION-mode hardenings may fail-fast a previously-tolerated insecure config: a non-https JWKS URI is now an ERROR (R11), and a credentialed-wildcard CORS config is no longer published (R15). DEVELOPMENT / COMMUNITY_DEFAULTS are unaffected.

Quality

./mvnw clean install (40 modules) green; -Pstatic-analysis verify green across all 25 library modules. No-mock discipline throughout; no ObjectInputStream; experimental-only API change. Touched modules retain their baseline by construction.

Migration

None for stable API. If you read JwksRefreshResult.error (experimental), switch to errorClass. Just bump the version to 00.76.10.

00.76.0000.77.00