)]}' { "log": [ { "commit": "962e3ee6b534262d517161581791b42df93becc3", "tree": "fab1e7e8cb5452037e4a10ab2fcec131febff2e6", "parents": [ "f3d9bbd4ae1d7f9a27a2a2a9af7afdfbd6e1afdf" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Oct 15 21:45:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 21:45:15 2026 +0200" }, "message": "KNOX-3518: Pin vitest to 4.1.11 to work around npm peer-resolution crash in UI builds (#1458)\n\nSince vitest 4.1.12 was published, `npm install` fails in every Angular\nUI module with \"Cannot read properties of null (reading \u0027edgesOut\u0027)\".\n\n@angular/build declares vitest as an optional peer. vitest 4.1.12\ndeclares the optional peer @vitest/browser-webdriverio ^4.1.11, which\nonly exists as 4.1.11 and requires vitest 4.1.11 exactly. The npm\nbundled with Node v22.20.0 (10.9.3) crashes on that conflict instead of\nreporting ERESOLVE. The UI poms delete package-lock.json on clean, so\nevery build hits it.\n\nOverride vitest to 4.1.11 in all UI modules. None of them uses vitest,\nso the build output is unchanged; the override can be removed once\nvitest publishes a consistent release.\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "f3d9bbd4ae1d7f9a27a2a2a9af7afdfbd6e1afdf", "tree": "a30753c48d7110403f3910b972f0c69f4eb3343b", "parents": [ "a4d73aaaa33b776751e93231e59d68d7287fb239" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Oct 15 10:57:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 10:57:17 2026 +0200" }, "message": "KNOX-3516: Log and describe JWT rejections caused by an untrusted issuer (#1457)" }, { "commit": "a4d73aaaa33b776751e93231e59d68d7287fb239", "tree": "041b44e3e786366ca6cb3f60c8184180dff12cf5", "parents": [ "2c88621767bc297a011aa1b27d5c097ac6d8ed98" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Oct 14 16:00:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 16:00:33 2026 +0200" }, "message": "KNOX-3514: Login and logout faviocn and title branding (#1455)" }, { "commit": "2c88621767bc297a011aa1b27d5c097ac6d8ed98", "tree": "a54b0f850d513dba32ba6f096fbd22725e5c8ae6", "parents": [ "fff8f54126471bcefcb15c37e96c0b27665fa1ff" ], "author": { "name": "hsheinblatt", "email": "hs7@hotmail.com", "time": "Wed Oct 14 06:25:20 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 09:25:20 2026 -0400" }, "message": "KNOX-3509 - Add k8s service DNS audience form, non-delegation audience validation, etc (#1448) via Harrison \u003chsheinblatt@cloudera.com\u003e" }, { "commit": "fff8f54126471bcefcb15c37e96c0b27665fa1ff", "tree": "7d4aee3712aac00c50b3c394be15f4ce8bf27162", "parents": [ "3c4c6e1b54090630ffcdd1d41acf563b743d01aa" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Oct 14 13:59:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 13:59:20 2026 +0200" }, "message": "KNOX-3512: Per-issuer CA bundle (jwksCa) for trusted OIDC issuers (#1451)" }, { "commit": "3c4c6e1b54090630ffcdd1d41acf563b743d01aa", "tree": "1e5bddbff75bb7454af4218544ffe465baeff6b2", "parents": [ "8a55ebe1ef5654d708871608c89a3bf39c482f23" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Oct 14 10:34:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 10:34:54 2026 +0200" }, "message": "KNOX-3513 - Add capped retry for resolving LDAP backend password aliases (#1453)\n\nLDAP backend password aliases (${ALIAS\u003d...}) that are not yet in the credential\nstore when the embedded LDAP service creates its interceptors can now be looked\nup again before they are left unresolved:\n\n- gateway.ldap.backend.password.alias.retry.attempts (default 0, no retry)\n- gateway.ldap.backend.password.alias.retry.interval.ms (default 1000)\n\nAll missing aliases are retried together, so the LDAP service waits at most\n(attempts x interval). Only missing aliases are retried; credential store errors\nare still reported right away.\n\nThe Knox CLI also initializes the LDAP service, so it never retries: otherwise\nevery knoxcli command - including the create-alias that provides the missing\nalias - would stall for the whole retry window.\n\nThe CI compose stack now creates the demoldap systemPassword alias only after\nKnox has started retrying the lookup, and a new test verifies from gateway.log\nthat the retry picked it up.\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "8a55ebe1ef5654d708871608c89a3bf39c482f23", "tree": "4595799e64cdf7df35774a4fa1076cf299fa51f7", "parents": [ "30a18b4e029198241a39e36534110c23d5d25568" ], "author": { "name": "Phil Zampino", "email": "pzampino@apache.org", "time": "Mon Oct 12 11:28:57 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 11:28:57 2026 -0400" }, "message": "KNOX-3510 - Normalize decoded dispatch URLs and reject path traversal (#1449)\n\nCo-authored-by: Claude Code \u003cnoreply@anthropic.com\u003e" }, { "commit": "30a18b4e029198241a39e36534110c23d5d25568", "tree": "9e0c0e92af7d327fee62aab93d4d7fad4621e607", "parents": [ "6842542eed56f9799e6d44cf1af9d1f1c610c3a8" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Mon Oct 12 16:01:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 16:01:58 2026 +0200" }, "message": "KNOX-3511: Gateway ignores gateway-reloadable.xml if the file did not exist at startup (#1450)" }, { "commit": "6842542eed56f9799e6d44cf1af9d1f1c610c3a8", "tree": "70705685a1d10e167078b7b820604f061ab5be5e", "parents": [ "07afc00386e178cee782edee92dc212fa3048fac" ], "author": { "name": "arsrivastava-cloudera", "email": "arsrivastava@cloudera.com", "time": "Sat Oct 10 20:41:57 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 10 11:11:57 2026 -0400" }, "message": "KNOX-3505 - Extend auth page themes to logout session page (#1442)\n\nShare theme loading via knox-theme.js on login and logout.jsp so branding\nmatches KNOX-3283 through SSO sign-out, including modern theme styling.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e" }, { "commit": "07afc00386e178cee782edee92dc212fa3048fac", "tree": "7a74dfc402684d9d7ab4d6b385656674460aeda4", "parents": [ "234b966c9d76b63a3b3114712137ffbc18700dac" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Oct 07 13:28:04 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 13:28:04 2026 +0200" }, "message": "KNOX-3506: Knox\u0027s default login page flashes before modern login page displayed (#1445)" }, { "commit": "234b966c9d76b63a3b3114712137ffbc18700dac", "tree": "a44f2ff209f8cb86a5ef9acf92cab4a624d3eb75", "parents": [ "bd52076f41885428b9bf8472c0877621f0f5a0a4" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Oct 07 12:10:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 12:10:19 2026 +0200" }, "message": "KNOX-3508: Bundle UI icons locally so they render in air-gapped networks (#1444)\n\n* KNOX-3508: Bundle UI icons locally so they render in air-gapped networks\n\nThe Angular 21 UI upgrade (KNOX-3234) and the mat-icon-based UIs\nreintroduced external font \u003clink\u003e tags to fonts.googleapis.com /\nfonts.gstatic.com for Material Icons (and Roboto in admin-ui),\nregressing KNOX-1731. In air-gapped environments the browser cannot\nfetch the icon font, so icons render as literal ligature text (e.g.\n\"settings\", \"push_pin\"). The production build also fetched the fonts at\nbuild time via Beasties critical-CSS inlining, so the build itself\nrequired internet access.\n\nVendor every icon used by the UIs as local inline SVGs (Google Material\nSymbols Outlined, Apache-2.0), remove all external font \u003clink\u003e tags, and\ndrop the Roboto web font in favor of the system font stack. No font/CSS\nis fetched at build or runtime.\n\n- gateway-admin-ui: new \u003capp-icon\u003e component + icon.data.ts render the\n SVGs; host keeps the material-icons class so existing theming applies.\n- home, token-generation, token-management: register inline SVGs with\n MatIconRegistry.addSvgIconLiteral and switch to \u003cmat-icon svgIcon\u003e.\n- Remove Google font links from all four index.html files; add a\n system-font fallback for the dropped Roboto web font.\n- Clean up two dead icon references found during analysis (an\n \u003ci class\u003d\"icon-warning\"\u003e with no backing font, and a Bootstrap-3\n glyphicon-info-sign that Bootstrap 5 no longer renders).\n- Delete orphaned fontawesome/fontopensans binaries (no references).\n- Add Material Symbols attribution to NOTICE.\n\nVerified: mvn package builds all four UI modules; the built index.html\nand hashed CSS/JS contain no googleapis/gstatic references.\n\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e" }, { "commit": "bd52076f41885428b9bf8472c0877621f0f5a0a4", "tree": "e3c3d2c1522c50bd69abd98e60f4e771e91bc024", "parents": [ "836bfe4cbf1fd37303a87cf897d2ff7e2f0f1e8d" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Tue Oct 06 09:37:18 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 09:37:18 2026 -0400" }, "message": "KNOX-3501 - JWT cookie tokens fail validation when knox.token.exp.server-managed\u003dtrue (#1441)" }, { "commit": "836bfe4cbf1fd37303a87cf897d2ff7e2f0f1e8d", "tree": "c17e6cfeada190ba110a322f056664c6b8ba06b3", "parents": [ "315ae7cff03182be4a5456b4d8fb50c947e4489d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 05 09:55:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 09:55:45 2026 +0200" }, "message": "Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 (#1418)" }, { "commit": "315ae7cff03182be4a5456b4d8fb50c947e4489d", "tree": "420508a3aa527e7c1707dc80488aba247c929639", "parents": [ "0bd23de3b09e5d12cd856837843e40f03f2f82f6" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Fri Oct 02 11:59:06 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 11:59:06 2026 +0200" }, "message": "KNOX-3488: Harden original-url cookie validation (#1429)\n\n* KNOX-3488: Harden original-url validation\n\n* KNOX-3488: Harden redirect and logout jsp originalUrl as well\n\n* KNOX-3488: WebSSOResourceTest for empty cookie, and valid originalUrl cookie is removed" }, { "commit": "0bd23de3b09e5d12cd856837843e40f03f2f82f6", "tree": "dc84877ea0c6506377e7bcf73b027c82b9c37e18", "parents": [ "efa4132f292e27144b7a64e47b99614a4cd2b456" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Oct 02 11:00:49 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 11:00:49 2026 +0200" }, "message": "KNOX-3498: Reject IP-literal OIDC issuer registration via topology-configurable flag (#1438)" }, { "commit": "efa4132f292e27144b7a64e47b99614a4cd2b456", "tree": "f385fc24f9856f6fd726c3c27d28614dc1bbf808", "parents": [ "9bb221513c9bf893687427fbf4698c60dd9db2fa" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Oct 02 10:35:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 10:35:40 2026 +0200" }, "message": "KNOX-3502: AliasService.isAlias recognizes the canonical ${ALIAS\u003d} prefix in addition to the Shiro-escaped S{ALIAS\u003d} form (#1439)" }, { "commit": "9bb221513c9bf893687427fbf4698c60dd9db2fa", "tree": "951bd1125491aa67ea527d5bf965f3f9193430b3", "parents": [ "7dfa327380a71ab16e33f25222bf20efd52e8de5" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Thu Oct 01 03:52:57 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 09:52:57 2026 +0200" }, "message": "KNOX-3498 - In cases of failures with OIDC issuer discovery url containing IP addresses log a proper error and warn message. (#1437)" }, { "commit": "7dfa327380a71ab16e33f25222bf20efd52e8de5", "tree": "65bab53c2e9c89554dcf02a891f767268f889bf3", "parents": [ "a42ffc3a1313ecdd440a4caf32b6ef2fd4b5fd63" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 30 11:32:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 11:32:29 2026 +0200" }, "message": "KNOX-3497: Resolve credential-store aliases in LDAP proxy backend password properties (#1436)" }, { "commit": "a42ffc3a1313ecdd440a4caf32b6ef2fd4b5fd63", "tree": "6260433b01699f69546752789eb3cd94987eb899", "parents": [ "b4d3ef225be5bdf81d602bba6d168c0a4aca6cd8" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Wed Sep 30 04:03:58 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 11:03:58 2026 +0200" }, "message": "KNOX-3496: LDAP Proxy requests memberOf attribute from backend (#1435)" }, { "commit": "b4d3ef225be5bdf81d602bba6d168c0a4aca6cd8", "tree": "ca0f4f28378456a3af2880714ab7fd14f8bb3bda", "parents": [ "a9e27337864cc6025b4eaf6603c77d5bde98f895" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Wed Sep 30 01:58:36 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 08:58:36 2026 +0200" }, "message": "KNOX-3485: Roles lookup replaces group entries with role entries (#1428)" }, { "commit": "a9e27337864cc6025b4eaf6603c77d5bde98f895", "tree": "fcffc6032a19ebeda4b9d3bc0af7add67d29c0c7", "parents": [ "8fc8018f7e21972f419e84b53c308431a0e405a1" ], "author": { "name": "hsheinblatt", "email": "hs7@hotmail.com", "time": "Tue Sep 29 11:52:05 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 20:52:05 2026 +0200" }, "message": "KNOX-3491 - Add pluggable request audience validation, with a Kubernetes destination validator (#1432)" }, { "commit": "8fc8018f7e21972f419e84b53c308431a0e405a1", "tree": "72c5312a64ed01765d62f1fb416c0e5f1df01821", "parents": [ "51ceaf2a23e78ffffecdf113c1f18796acabbeac" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Tue Sep 29 20:02:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 20:02:07 2026 +0200" }, "message": "KNOX-3493: Add k8s SA policy-enforced actor-token and headless requested_subject delegation E2E tests (#1434)" }, { "commit": "51ceaf2a23e78ffffecdf113c1f18796acabbeac", "tree": "bae33846dc284553bc9375c9ffcc27b70b1234ce", "parents": [ "119d4882912d8f3e5ae3b4dcf1e1a67ff4935804" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Tue Sep 29 10:30:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 10:30:02 2026 +0200" }, "message": "KNOX-3492: Update CHANGES with 2.1.1 release (#1433)" }, { "commit": "119d4882912d8f3e5ae3b4dcf1e1a67ff4935804", "tree": "b5948e0b12e91fe273251f2ea0b5306ffa64abae", "parents": [ "7d4e4facc09318354d51bcee9b2f8d248dfca638" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Mon Sep 28 16:48:12 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 16:48:12 2026 +0200" }, "message": "KNOX-3490: Key LDAP roles lookup on the uid attribute, augmenting the backend search with it when the client omits it (#1431)" }, { "commit": "7d4e4facc09318354d51bcee9b2f8d248dfca638", "tree": "181793e2d6755fb867caebadd9a7041f2912bbb4", "parents": [ "7489115c47990bf4524f68660576ff9bab91f13d" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Sep 25 20:33:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 25 20:33:01 2026 +0200" }, "message": "KNOX-3489: Log request/response when calling remote role lookup server (#1430)" }, { "commit": "7489115c47990bf4524f68660576ff9bab91f13d", "tree": "f463d1d4a286ea67a60ff48061faef262e695d05", "parents": [ "189d1f73b1b46b17e99dbb76d54ccdad9f490be8" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Thu Sep 24 09:21:22 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 09:21:22 2026 -0400" }, "message": "KNOX-3478 - Add support to forward auth tokens in KNOX-AUTH-SERVICE (#1425)\n\n* KNOX-3478 - Add support to forward auth tokens in KNOX-AUTH-SERVICE\n\n* KNOX-3478 - Fix compilation issues" }, { "commit": "189d1f73b1b46b17e99dbb76d54ccdad9f490be8", "tree": "73bd993ecdbe0b81c159f7feb0f72ab74b21ad9c", "parents": [ "ef67c1d20293c921b3e9b296d99d8030ad79f360" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 23 18:02:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 23 18:02:47 2026 +0200" }, "message": "KNOX-3480: Support user-supplied clientId in the Client Credentials endpoint (#1422)" }, { "commit": "ef67c1d20293c921b3e9b296d99d8030ad79f360", "tree": "431ed075905455d9855fa6e0070d5ae4a963a5fd", "parents": [ "40097fc48401f055a8c655ec56abdae4283714bc" ], "author": { "name": "Raghav Maheshwari", "email": "168407455+Raghav-Mah3shwari@users.noreply.github.com", "time": "Wed Sep 23 12:56:01 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 23 09:26:01 2026 +0200" }, "message": "KNOX-3452: Add comprehensive unit tests for MimeTypes (#1393)\n\n* KNOX-3452: Add comprehensive unit tests for MimeTypes\n\n* fixed the test as per reviews given by hanicz\n\n---------\n\nCo-authored-by: Raghav Maheshwari \u003craghav.maheshwari@komprise.com\u003e" }, { "commit": "40097fc48401f055a8c655ec56abdae4283714bc", "tree": "cba5da719eb3b104287e77d0fcb7909b1486502d", "parents": [ "fbf3332c42681356348da37dea4a055e5bdfc14a" ], "author": { "name": "samuhasavak5", "email": "samuhasavak5@gmail.com", "time": "Mon Sep 21 17:47:31 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 14:17:31 2026 +0200" }, "message": "KNOX-3474: Add spark4historyui Knox service definition (#1413)" }, { "commit": "fbf3332c42681356348da37dea4a055e5bdfc14a", "tree": "e5b585984b45caaf1e5c197ad6687a55a121dcb9", "parents": [ "02428a7d5457dabe36af182a0f877e6120b0432d" ], "author": { "name": "samuhasavak5", "email": "samuhasavak5@gmail.com", "time": "Mon Sep 21 17:45:23 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 14:15:23 2026 +0200" }, "message": "KNOX-3473: Add livy_for_spark4 Knox service definition (#1412)" }, { "commit": "02428a7d5457dabe36af182a0f877e6120b0432d", "tree": "ac55b2ad676e61b023d60895f75fda0816785f6d", "parents": [ "d4e995e234c842161982b6d0ceab1173b0073f66" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Mon Sep 21 13:39:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 13:39:52 2026 +0200" }, "message": "KNOX-3477: Capture the RFC 8693 delegation actor-chain in gateway-audit.log (#1419)" }, { "commit": "d4e995e234c842161982b6d0ceab1173b0073f66", "tree": "ec31e5ac153c5d18661526cc5c6356408956be85", "parents": [ "b0fc823bfadfca30eb582cbfaa66a5ac62dd05cf" ], "author": { "name": "samuhasavak5", "email": "samuhasavak5@gmail.com", "time": "Mon Sep 21 12:08:51 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 08:38:51 2026 +0200" }, "message": "KNOX-3472: Add livy_for_spark3 Knox service definition (#1411)" }, { "commit": "b0fc823bfadfca30eb582cbfaa66a5ac62dd05cf", "tree": "9b436e8db68ff38f2f4ff751d1cdf26dbe8e5fdc", "parents": [ "20b6d6beaac13bd8701ea5257b607b5d1b72f480" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Sat Sep 19 08:51:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 08:51:02 2026 +0200" }, "message": "KNOX-3476: add RFC 8693 delegation-path integration tests (policy lookup, act/aud minting, TTL cap, headless) (#1416)" }, { "commit": "20b6d6beaac13bd8701ea5257b607b5d1b72f480", "tree": "c9398087bfd066be627c754f5f3ac809ee798173", "parents": [ "d2d808ae061c179300662191f8fe7ab0448e2165" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Fri Sep 18 17:12:56 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 17:12:56 2026 -0400" }, "message": "KNOX-3470 - Add support for /.well-known/oauth-authorization-server (#1417)" }, { "commit": "d2d808ae061c179300662191f8fe7ab0448e2165", "tree": "82a199bd4522ef5a30484440ecb85a71e9d8d8b2", "parents": [ "d1204b9c835dffd3c24d7a38a9c5b5f4360eaf60" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Sep 18 15:50:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 15:50:46 2026 +0200" }, "message": "KNOX-3475: enforce delegation policy status at authorization time so a revoked (not deleted) policy no longer authorizes token exchange (#1414)" }, { "commit": "d1204b9c835dffd3c24d7a38a9c5b5f4360eaf60", "tree": "7a47abd1ce623aca5b2d72dc8c34edadfabd590a", "parents": [ "fe51d3d8d3d2c863e75901420d326c9f5581ca87" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Sep 18 10:57:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 10:57:20 2026 +0200" }, "message": "KNOX-3460: audit all RFC 8693 token-exchange paths pre-mint and add a mint-time TOKEN_EXCHANGE audit emitting jti/expiry/issued_subject (#1409)" }, { "commit": "fe51d3d8d3d2c863e75901420d326c9f5581ca87", "tree": "a94b3e465c02fda6eed21c82a614490a8f318c8a", "parents": [ "1bebbfa2d97a6b75f61a029ad37ec7facee653b9" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Sep 18 09:03:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 09:03:52 2026 +0200" }, "message": "KNOX-3464: document KnoxIDF RFC 8693 token exchange \u0026 delegation; fix KnoxIDF config reference (#1410)" }, { "commit": "1bebbfa2d97a6b75f61a029ad37ec7facee653b9", "tree": "9daded108f628b3d83c39886d5bdba59dec5d890", "parents": [ "377d841b784f04e10e88d8a01456734e9bb3e2a1" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Thu Sep 17 14:36:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 14:36:26 2026 +0200" }, "message": "KNOX-3471: KnoxIDF expires_in should return relative second instead o… (#1408)\n\n* KNOX-3471: KnoxIDF expires_in should return relative second instead of absolute epoch-ms\n\n* KNOX-3471: Remove expires_in if there is no expiry" }, { "commit": "377d841b784f04e10e88d8a01456734e9bb3e2a1", "tree": "9770a5802f56a151577fae8f949cb6a288fc2098", "parents": [ "6c34ad442e90148d8956e7e595d2187b51e563b4" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Sep 17 11:47:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 11:47:16 2026 +0200" }, "message": "KNOX-3466: add CI integration tests for RFC 8693 same-subject requested-audience authorization (#1407)" }, { "commit": "6c34ad442e90148d8956e7e595d2187b51e563b4", "tree": "79703282821fa0715dcb06e8b5f929b60fa3f329", "parents": [ "da99fa6c718dbed1b04de9aeb1f21ad79ae27021" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Sep 17 10:45:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 10:45:20 2026 +0200" }, "message": "KNOX-3461: authorize same-subject requested audience against the subject token\u0027s aud via delegation.same.subject.requested.audience.enabled (#1405)" }, { "commit": "da99fa6c718dbed1b04de9aeb1f21ad79ae27021", "tree": "36e5d4147f0cc1d81eb698ebf2d0dbc348c8fa67", "parents": [ "78b94fa1169126226701dcc536dabd62dbd1cecc" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 16 15:17:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 15:17:03 2026 +0200" }, "message": "KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) (#1406)" }, { "commit": "78b94fa1169126226701dcc536dabd62dbd1cecc", "tree": "1c2a9df540c97451e38f3c6bac6f958e1cb39f4a", "parents": [ "29a65200a009e4b3924304db89efc18f52e7ebe2" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 16 14:40:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 14:40:21 2026 +0200" }, "message": "KNOX-3238: Migrate from javax.servlet to jakarta.servlet servlet-api (#1388)" }, { "commit": "29a65200a009e4b3924304db89efc18f52e7ebe2", "tree": "ceea8e0d5f1151ce534ffedd92d6b918744379fc", "parents": [ "1460b2b115060c79bff9dfc0bfe8ba0af4bc8196" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Sep 16 13:17:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 13:17:26 2026 +0200" }, "message": "Backport v3.0.0 docs changes to master and changing version to 3.1.0 (#1404)\n\n* Update github docs to 3.0.0\n\n(cherry picked from commit ffb0f996e9b641588feb513b098c85ccd88189f6)\n\n* Update github docs to 3.0.0\n\n(cherry picked from commit 9797d73f87aba98ef9b9a9f7b88208b50b8b25bf)\n\n* KNOX-3463: Change version to 3.1.0" }, { "commit": "1460b2b115060c79bff9dfc0bfe8ba0af4bc8196", "tree": "d6d346302466704ca809568ceccd218162ce7028", "parents": [ "cc6ec9354882af0358c05f44584b816cb8d56871" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 16 11:42:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:42:57 2026 +0200" }, "message": "KNOX-3458: enforce a configurable maximum actor-chain depth in token exchange (#1400)" }, { "commit": "cc6ec9354882af0358c05f44584b816cb8d56871", "tree": "7e34a2ce5007cc79f2f9200d5f936a881e2deea2", "parents": [ "736c2152b9360229a7915e27426cd19630954e43" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 16 10:00:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 10:00:53 2026 +0200" }, "message": "KNOX-3459: honor delegation policy tokenTtlSec as the minted token\u0027s expiry basis (#1401)" }, { "commit": "736c2152b9360229a7915e27426cd19630954e43", "tree": "8bb82bbc3934164bb7000df3f18ea019dc655290", "parents": [ "095ade4f5411a633c49d2e04616efe44a6c2b72e" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Sep 16 09:48:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 09:48:32 2026 +0200" }, "message": "KNOX-3462: Fix github docs links (#1403)" }, { "commit": "095ade4f5411a633c49d2e04616efe44a6c2b72e", "tree": "5f564c7e80a95f78fefbe45863107fc01129a5bd", "parents": [ "c9e04a02ee1854c7c6d38b26f09ebd690215c39a" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 16 09:07:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 09:07:37 2026 +0200" }, "message": "KNOX-3456: resolve canActFor.groups via KnoxLDAPService group lookup, failing with server_error when LDAP is unavailable (#1402)" }, { "commit": "c9e04a02ee1854c7c6d38b26f09ebd690215c39a", "tree": "48da3d401f61e01b8705baf8a5469e1767d637d8", "parents": [ "9c0a6ccb75524e688837fa9d76911f923b95b8c5" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Tue Sep 15 18:15:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 18:15:47 2026 +0200" }, "message": "KNOX-3457: Remove unused delegation.requested.scope.enabled provider parameter (#1399)" }, { "commit": "9c0a6ccb75524e688837fa9d76911f923b95b8c5", "tree": "633a2c7321f61c3077b20cc8200041279b17b1b3", "parents": [ "6b4d83e4961a3a5bb860ecfaecfc3f0c22cf8539" ], "author": { "name": "hsheinblatt", "email": "hs7@hotmail.com", "time": "Tue Sep 15 05:07:18 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 14:07:18 2026 +0200" }, "message": "KNOX-3441: add delegated token exchange (actor-token and headless) with policy enforcement and audit (#1398)" }, { "commit": "6b4d83e4961a3a5bb860ecfaecfc3f0c22cf8539", "tree": "a9c50749211d71f7e9027b108959117eced1156c", "parents": [ "746c86592a0382673c8b8102f5036daf4c581dca" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Mon Sep 14 13:46:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 13:46:23 2026 +0200" }, "message": "KNOX-3453: Ignore runtime-generated gateway-server/data/security directory in git (#1397)" }, { "commit": "746c86592a0382673c8b8102f5036daf4c581dca", "tree": "d07d0609f8cc021d63d644c3d8c289d6b71e6149", "parents": [ "739011b0c16e44697f09dfcbccc2ea1e7c7258aa" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Mon Sep 14 12:53:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 12:53:24 2026 +0200" }, "message": "KNOX-3449: Prove Knox accepts Kubernetes ServiceAccount tokens on the RFC 8693 token-exchange path (#1396)" }, { "commit": "739011b0c16e44697f09dfcbccc2ea1e7c7258aa", "tree": "83e735fe83509e6665eb789f5a7a5cd0283cd389", "parents": [ "ea1378ada342a89902db5a1c15e34b00c00e70cc" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Mon Sep 14 09:38:25 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 09:38:25 2026 +0200" }, "message": "KNOX-3445: KnoxIDF admin service stays disabled (Empty stub) when KNOXIDF_ADMIN topology is hot-deployed after gateway startup (#1394)\n\n* KNOX-3445: Default KnoxIDF service factories to H2 instead of topology-gated Empty stubs\n\n* KNOX-3445: New tests for JDBC impls" }, { "commit": "ea1378ada342a89902db5a1c15e34b00c00e70cc", "tree": "b065964fb08fed5fd0ee71a31bc25aaf6ba9b089", "parents": [ "3f520b7661600c4fc663fdc3dcb45623a3813b1a" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Mon Sep 14 09:12:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 09:12:52 2026 +0200" }, "message": "KNOX-3446: Change version to 3.1.0, Update NOTICE and CHANGES (#1386)\n\n* KNOX-3446: Change version to 3.1.0, Update NOTICE and CHANGES\n\n* KNOX-3446: Change version to 3.1.0 for opensaml shim" }, { "commit": "3f520b7661600c4fc663fdc3dcb45623a3813b1a", "tree": "461c92791ee2225c721ff54ed8645e121f510069", "parents": [ "8697bc73677e46f8afbc4b442cf39a8aa5188576" ], "author": { "name": "shreyaaryaofficial", "email": "shreyaaryaofficial@gmail.com", "time": "Mon Sep 14 12:33:56 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 09:03:56 2026 +0200" }, "message": "KNOX-3410: Add unit tests for XForwardedHeaderRequestWrapper (#1391)\n\nCo-authored-by: Shreya Arya \u003cshreyaarya@Shreyas-MacBook-Air.local\u003e" }, { "commit": "8697bc73677e46f8afbc4b442cf39a8aa5188576", "tree": "b7461fad977b4ec69ef625c3af664d6e8dd08934", "parents": [ "0a3a7949b091dcdc3f609f1f95c1dd95d3f91b0c" ], "author": { "name": "bonampak", "email": "bonampak@apache.org", "time": "Fri Sep 11 13:49:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 13:49:37 2026 +0200" }, "message": "KNOX-3444: Optimize CM discovery memory usage by only caching role configurations that ServiceModelGenerators actually use (#1392)\n\n* KNOX-3444: Skip caching CM discovery role configs for role types no ServiceModelGenerator uses\n\n* KNOX-3444: Filter each page as it arrives in ServiceRoleCollectorByService so unneeded configs do not accumulate.\n\n* KNOX-3444: When requiredTypeNames is empty in TypeNameFilter, exclude every role as no service model would be generated." }, { "commit": "0a3a7949b091dcdc3f609f1f95c1dd95d3f91b0c", "tree": "1aa513d660e0f461727e244b594503c74f274fe2", "parents": [ "b2d2843c602c5810fe2fa75542debe81a8c6a608" ], "author": { "name": "Phil Zampino", "email": "pzampino@apache.org", "time": "Thu Sep 10 14:31:31 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 14:31:31 2026 -0400" }, "message": "KNOX-3450: Add Transfer-Encoding to set of excluded headers in PassAllHeadersDispatch (#1389)\n\nPassAllHeadersDispatchTest.java Generated-by: Claude Code" }, { "commit": "b2d2843c602c5810fe2fa75542debe81a8c6a608", "tree": "22c94403d54bce7ec32f3debbc3b4dd93d89a5ed", "parents": [ "38cc0f47bf384324cc1a7e77104227c1da8d57bf" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Thu Sep 10 15:03:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 09:03:50 2026 -0400" }, "message": "KNOX-3447: Harden ServiceDefinitonUnmarshaller (#1387)" }, { "commit": "38cc0f47bf384324cc1a7e77104227c1da8d57bf", "tree": "e76542db2cc16101ea226f00f5a8cc0e34a800e8", "parents": [ "8872f980e8ac326d498b74f910e50f60a2f8de76" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Wed Sep 09 09:30:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 09:30:32 2026 +0200" }, "message": "KNOX-3442: Reject INIT/RUNSCRIPT/ALIAS in H2 database name to prevent JDBC-URL code execution (#1383)" }, { "commit": "8872f980e8ac326d498b74f910e50f60a2f8de76", "tree": "ba444009ee6bcac017c745441b8fb9d569dbbbbb", "parents": [ "6e025705b1845da75fda2ecd58f88d7182afafcc" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Tue Sep 08 11:32:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 11:32:37 2026 +0200" }, "message": "KNOX-3438: Address review comments from delegation policy admin API (#1381)\n\n* KNOX-3438: read delegation policy TTL bounds from topology init-params with fail-fast validation instead of gateway config\n\n* KNOX-3438: use app clock for delegation policy updated_at to match created_at\n\n* KNOX-3438: audit delegation policy read endpoints (list, getOne) under Action.ACCESS\n\n* KNOX-3438: validate configured default token TTL against admin API bounds at startup" }, { "commit": "6e025705b1845da75fda2ecd58f88d7182afafcc", "tree": "3e53d02d5b14cfb5c3ff14a1f24808e12866cc6c", "parents": [ "a919d15f5369c859625368ad21076628f50c29f8" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Tue Sep 08 11:32:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 11:32:11 2026 +0200" }, "message": "KNOX-3440: Remove HSQLDB completely from Knox (#1382)" }, { "commit": "a919d15f5369c859625368ad21076628f50c29f8", "tree": "316d318eb38a8fccaaf1d8b6169628d329d40a47", "parents": [ "6fce04225dc8de328e25ad76b38e98afd4397c4c" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Tue Sep 08 09:21:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 09:21:02 2026 +0200" }, "message": "KNOX-3401: Replace Derby with H2 (#1380)" }, { "commit": "6fce04225dc8de328e25ad76b38e98afd4397c4c", "tree": "eddaf36a67562bc10923d8bc3f8250c2fd0a6e67", "parents": [ "7b90d0da3ae3a9c2e10a9a93900f1728930d3b2f" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Mon Sep 07 22:36:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 22:36:52 2026 +0200" }, "message": "KNOX-3432: Advertise RFC 8693 token-exchange and client_credentials grant types in KnoxIDF discovery metadata (#1376)" }, { "commit": "7b90d0da3ae3a9c2e10a9a93900f1728930d3b2f", "tree": "c9c499a3079721ba12420405a7b2eed9dc4f42dd", "parents": [ "a8a43ae887a6dc61bffcb8eb1a9bf20dfca356a4" ], "author": { "name": "Raghav Maheshwari", "email": "168407455+Raghav-Mah3shwari@users.noreply.github.com", "time": "Tue Sep 08 00:12:45 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 20:42:45 2026 +0200" }, "message": "KNOX-3439: Add tests for NoClassNameMultiLineToStringStyle (#1378)\n\nCo-authored-by: Raghav Maheshwari \u003craghav.maheshwari@komprise.com\u003e" }, { "commit": "a8a43ae887a6dc61bffcb8eb1a9bf20dfca356a4", "tree": "748e341ae75263014b7068d7497db3edbbf475bb", "parents": [ "e70fe0fae4326d8ecf1a6d2695a39cecd64b36e8" ], "author": { "name": "hsheinblatt", "email": "hs7@hotmail.com", "time": "Mon Sep 07 01:39:05 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 10:39:05 2026 +0200" }, "message": "KNOX-3438: Add delegation policy admin API with upsert support for RFC 8693 token exchange (#1379)" }, { "commit": "e70fe0fae4326d8ecf1a6d2695a39cecd64b36e8", "tree": "60886898cc528016dd17a3bae2234e1a85bbcbc8", "parents": [ "3cb11c6a0b33d7bb00ba6791bae71e3385543fec" ], "author": { "name": "hsheinblatt", "email": "hs7@hotmail.com", "time": "Fri Sep 04 08:50:56 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 11:50:56 2026 -0400" }, "message": "KNOX-3434 - Allow missing typ when validating JWTs from TrustedOidcIssuers for token exchange. (#1377)\n\n* For token exchange with tokens from a trusted issuer, allow missing typ.\n\n* Fix comments\n\n---------\n\nCo-authored-by: Harrison \u003chsheinblatt@cloudera.com\u003e" }, { "commit": "3cb11c6a0b33d7bb00ba6791bae71e3385543fec", "tree": "c30633d65304261b10e8cc5beff0d8c7efd9c728", "parents": [ "6f94600951397379670ab5aa30d15a5f2f51a6c2" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Sep 03 18:06:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 18:06:52 2026 +0200" }, "message": "KNOX-3424: Complete RFC 8707/8693 dynamic resource/audience handling in KNOXTOKEN and token exchange (#1373)" }, { "commit": "6f94600951397379670ab5aa30d15a5f2f51a6c2", "tree": "49759213c55d8e7e9d78b1c9504bf3fb8d9a850f", "parents": [ "af3b2989a142f9196f81308a3779df6531fc40ca" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Sep 03 17:53:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 17:53:38 2026 +0200" }, "message": "KNOX-3433: set issued_token_type in KnoxIDF token responses (RFC 8693 §2.2.1) (#1375)" }, { "commit": "af3b2989a142f9196f81308a3779df6531fc40ca", "tree": "b728a8928983ba46c9e4d8a2ec15fa584f67a5fe", "parents": [ "683841bf781e6125b60af6159674a61dc12cee34" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Thu Sep 03 15:42:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 15:42:56 2026 +0200" }, "message": "KNOX-3426: Embedded-Derby delegation policy service (#1374)" }, { "commit": "683841bf781e6125b60af6159674a61dc12cee34", "tree": "bf358c2f3975e8adf49c421e58d758178ac344ce", "parents": [ "8ac5a458883963c4b19cded8e2209ccdce968ceb" ], "author": { "name": "hsheinblatt", "email": "hs7@hotmail.com", "time": "Wed Sep 02 23:38:54 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 08:38:54 2026 +0200" }, "message": "KNOX-3426 - Add DelegationPolicyService schema, interface, and JDBC implementation (#1361)" }, { "commit": "8ac5a458883963c4b19cded8e2209ccdce968ceb", "tree": "7357d0be62e416cd4e66a91cbba2ab5a1055e981", "parents": [ "f77ffb21f9244f4147a0b02c53b1b014440b4493" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Wed Sep 02 10:23:41 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 17:23:41 2026 +0200" }, "message": "KNOX-3431: UserSearchInterceptor throws exceptions on failed search (#1372)" }, { "commit": "f77ffb21f9244f4147a0b02c53b1b014440b4493", "tree": "00dbbe8241a2861b517c93d44fae80a02eb53fd7", "parents": [ "a5fb4e761785323763f99b6961ce0320da3b02ee" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Sep 02 09:45:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 09:45:02 2026 +0200" }, "message": "KNOX-3424: Dynamic audience handling in the KNOXTOKEN service (#1356)\n\n* KNOX-3424: Dynamic audience handling in the KNOXTOKEN service\n\n* KNOX-3424: Address review comments\n\n* KNOX-3424: Introduce strategy pattern for audience validation and resolve\n\n* KNOX-3424: New passthrough validator" }, { "commit": "a5fb4e761785323763f99b6961ce0320da3b02ee", "tree": "15cfd4ea7783cc69de6675567c50fb75d57ee580", "parents": [ "7d719ca06d1179c5ca2a22312623e91768c5b6f2" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Sep 02 09:39:12 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 09:39:12 2026 +0200" }, "message": "KNOX-3419: Tests for the recent improvements (#1369)\n\n* KNOX-3419: Tests for the recent improvements\n\n* KNOX-3419: Remove knoxsso redirect whitelist param" }, { "commit": "7d719ca06d1179c5ca2a22312623e91768c5b6f2", "tree": "de49c2c42c1f6b23709ef1d01d7ade1e93f4738d", "parents": [ "31419b7fc0bed3fb117dd714bfceb46bbbedb56e" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Sep 02 09:21:12 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 09:21:12 2026 +0200" }, "message": "KNOX-3430: Deprecate AccessTokenFederationFilter, also added UnsupportedOperatorException (#1370)" }, { "commit": "31419b7fc0bed3fb117dd714bfceb46bbbedb56e", "tree": "56b70a5d334938a8c5751390c6d0ffd38a6ec1f8", "parents": [ "1f5d5c0617d500c8f46fad2eed60135984b3e414" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Wed Sep 02 01:24:35 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 08:24:35 2026 +0200" }, "message": "KNOX-3422: Update service_ldap_server.md (#1371)\n\nRemoved a note from docs that assumed that the credentials change wouldn\u0027t make it into 3.0.0." }, { "commit": "1f5d5c0617d500c8f46fad2eed60135984b3e414", "tree": "c5d816020411e6cee4a047c4b9a6cb3eb8bf0eeb", "parents": [ "c40480ea2cb98214d53485e09bccbf834479557a" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Tue Sep 01 13:57:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 13:57:08 2026 +0200" }, "message": "KNOX-3429: Harden source assembly to exclude build caches, runtime state, and staging dirs (#1368)" }, { "commit": "c40480ea2cb98214d53485e09bccbf834479557a", "tree": "034f02b53efe8d2aae428080dfe05a5aa572e067", "parents": [ "c213bba6318e53cd32ef3c3fd79a92750af9f270" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Mon Aug 31 21:43:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 21:43:31 2026 +0200" }, "message": "KNOX-3428: Bump Spring to 6.2.19 and add HashiCorp Vault alias service integration tests (#1367)" }, { "commit": "c213bba6318e53cd32ef3c3fd79a92750af9f270", "tree": "681f4f68683654b9a93d078b31dc8a9670ae7a77", "parents": [ "1832299cf402365c9ca35199c5748dd9aade9b13" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Mon Aug 31 16:31:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:31:44 2026 +0200" }, "message": "KNOX-3427: Bump Netty to 1.137.Final due to CVEs (#1366)" }, { "commit": "1832299cf402365c9ca35199c5748dd9aade9b13", "tree": "9261f6d19f0d015fc2b268d570719ca0188d9a57", "parents": [ "2a909a70d6fbb233c07d8b49ae3efd72ac7c9064" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Mon Aug 31 13:13:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 13:13:45 2026 +0200" }, "message": "KNOX-3423: Switch to JSON error messages in Knox token validation paths (#1354)\n\n* KNOX-3424: Switch to JSON error messages in Knox token validation paths\n\n* KNOX-3423: Address review comments" }, { "commit": "2a909a70d6fbb233c07d8b49ae3efd72ac7c9064", "tree": "37476e6d63d49cfe8e50f18df92f4f5fa9f57823", "parents": [ "1e254616172b5bae8fae3297584ad9aa37fb4e23" ], "author": { "name": "Raghav Maheshwari", "email": "168407455+Raghav-Mah3shwari@users.noreply.github.com", "time": "Mon Aug 31 15:01:41 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 11:31:41 2026 +0200" }, "message": "KNOX-3395: Add KNOXTOKEN issuance and JWTProvider federation integration tests (#1325)\n\n* KNOX-3395: Add KNOXTOKEN issuance and JWTProvider federation integration tests" }, { "commit": "1e254616172b5bae8fae3297584ad9aa37fb4e23", "tree": "4cf3034ce4f67d5cbf87250ef15ed288c269009b", "parents": [ "95e3b66034ad309542354e6a2fb4c80cefdbe080" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Aug 31 11:29:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 11:29:46 2026 +0200" }, "message": "Bump org.mariadb.jdbc:mariadb-java-client from 3.3.0 to 3.3.5 (#1363)\n\nBumps [org.mariadb.jdbc:mariadb-java-client](https://github.com/mariadb-corporation/mariadb-connector-j) from 3.3.0 to 3.3.5.\n- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)\n- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.3.0...3.3.5)\n\n---\nupdated-dependencies:\n- dependency-name: org.mariadb.jdbc:mariadb-java-client\n dependency-version: 3.3.5\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "95e3b66034ad309542354e6a2fb4c80cefdbe080", "tree": "0b231a6fde472aa60811d36794006b0817dc13af", "parents": [ "c7761322d5534f5807aa1967727e8887106cf107" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Fri Aug 28 07:22:21 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 07:22:21 2026 -0400" }, "message": "KNOX-3420 - Upgrade Jetty from 9.x 12.x (#1360)\n\nCo-authored-by: Tamás Marcinkovics \u003cbonampak@apache.org\u003e" }, { "commit": "c7761322d5534f5807aa1967727e8887106cf107", "tree": "aba7b713b61bc0257ba733ae61ea2d2677766786", "parents": [ "d9105101dcdf9f390fc36eafad597e7c16676cfe" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Fri Aug 28 02:43:46 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 09:43:46 2026 +0200" }, "message": "KNOX-3422: Ldap Proxy used in-memory bind user (#1357)\n\n* KNOX-3422: Ldap Proxy used in-memory bind user\n\nThe bind user created from the gateway configuration is now created\nin-memory instead of being added to the embedded ldap server. This\nprovides the benefit of being able to rotate the user just by changing\nthe configuration. Previously, since the configured user is not tracked,\nthere wasn\u0027t a way to automatically rotate the user.\n\n* throw LdapAuthenticationException" }, { "commit": "d9105101dcdf9f390fc36eafad597e7c16676cfe", "tree": "bbd8f04d62cf6002651c1dfea4aab3e23c60442a", "parents": [ "1cfef0d532f5f70dc434ae65f1668e95ef71a672" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Fri Aug 28 02:43:11 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 09:43:11 2026 +0200" }, "message": "KNOX-3406: LDAP Proxy backend improve error handling (#1355)\n\n* KNOX-3406: LDAP Proxy backend improve error handling\n\nThe LdapProxyBackend.getUser code was modified to ensure that the search\ncursor is closed before attempting to augment the entry with group memberships\nto avoid having simultaneously open cursors.\n\nThe error handling in performPagedSearch was improved such that unsuccessful\npaging calls will result in exceptions for the caller to handle.\n\n* add null-handling for SearchResultDone" }, { "commit": "1cfef0d532f5f70dc434ae65f1668e95ef71a672", "tree": "17b3d969c83a43eb26bca3b35a459bf1295d4a29", "parents": [ "9522a5b540c50bea590745db77d27d153caec7a2" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Thu Aug 27 04:10:26 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 11:10:26 2026 +0200" }, "message": "KNOX-3425: LDAP Proxy disallows anonymous binds to remote backends (#1358)\n\nThe LdapProxyBackend.authenticate method will now return false if either\nthe given DN or password is empty to prevent unauthorized and anonymous binds.\n\nThe UserSearchInterceptor is also updated to not call the backend if the DN\nor password is empty." }, { "commit": "9522a5b540c50bea590745db77d27d153caec7a2", "tree": "1fca4b4205256cf422160fd1a0cd5d4d72ea198e", "parents": [ "114af08db662222a6db636ea5ab364e1b1fa2d1e" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Fri Aug 21 15:50:16 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 21 15:50:16 2026 -0400" }, "message": "KNOX-3421 - Upgrade Shiro to 2.2.1 (#1353)\n\n* KNOX-3421 - Upgrade Shiro to 2.2.1\n\n* KNOX-3421 - Review fixes\n\n* KNOX-3421 - Test and add LDAP caching tests\n\n* KNOX-3421 - Address build failures" }, { "commit": "114af08db662222a6db636ea5ab364e1b1fa2d1e", "tree": "2dbfd7f12881f4eb44d42e9c47085c3f2b5258bf", "parents": [ "d0360562e996798722d52ee64a7b5fc48e4c6745" ], "author": { "name": "bonampak", "email": "bonampak@apache.org", "time": "Wed Aug 19 16:39:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 19 16:39:42 2026 +0200" }, "message": "KNOX-3278: Update JLine to 3.30.6 (#1181)\n\n* KNOX-3278: Update jline.version to 3.25.1.\n\n* KNOX-3278: Update groovy to 5.0.4 and jline to 3.30.6, plus jna to 5.18.1.\n\n* KNOX-3278: refactor commands and REPL shell.\n\n* KNOX-3278: fix checkstyle errors and logging configuration in maven-shade-plugin and knoxshell-log4j. Update aspectj for JDK 17.\n\n* KNOX-3278: Fix forbiddenapis check: use Locale.ROOT in printf.\n\n* KNOX-3278: Fix KnoxShellTableCallHistoryTest shouldRollbackToValidPreviousStep\n\n* KNOX-3278: Removing comments and unused methods\n\n* KNOX-3278: Fix missing newlines at end of file.\n\n* KNOX-3278: Restoring SelectCommand to use Swing JTextArea for multiline edits.\n\n* KNOX-3278: Removing KnoxLoginDialog (JLine3 supports password input).\n\n* KNOX-3278: Correcting undeclared jline module dependencies.\n\n* KNOX-3278: Correcting pmd findings.\n\n* KNOX-3278: Update rest-assured to 6.0.0 (needed for Groovy 5)\n\n* KNOX-3278: command completion pt1\n\n* KNOX-3278: command completion pt2\n\n* KNOX-3278: correct checkstyle errors\n\n* KNOX-3278: correct undeclared jline module dependencies.\n\n* KNOX-3278: cleanup DataSourceCommand completer.\n\n* KNOX-3278: add :x and :q as exit commands.\n\n* KNOX-3278: add \u0027?\u0027 as help command alias.\n\n* KNOX-3278: import, load and show commands added.\n\n* KNOX-3278: purge command added.\n\n* KNOX-3278: Correcting load command and alias.\n\n* KNOX-3278: Adding completer for ShowCommand.\n\n* KNOX-3278: Correct checkstyle error on shortcut handling\n\n* KNOX-3278: Renaming SimpleCommandRegistry to KnoxShellCommandRegistry and cleaning up command handling. Overriding name() so that tab completion after semicolon does not show the name of the command registry.\n\n* KNOX-3278: No need to exclude Log4j2Plugins.dat from the shaded knoxhsell jar.\n\n* KNOX-3278: correcting knoxshell.sh to use -jar instead of main class (to use Launcher taken from knoxshell.jar manifest main class)\n\n* KNOX-3278: excluding Log4j2Plugins.dat from the shaded knoxhsell jar and making knoxshell-log4j2.xml consistent with other log4j2 configurations.\n\n* KNOX-3278: get rid of useless warning javax.* types are not being woven\n\n* KNOX-3278: fix log4j2 WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.\n\n* KNOX-3278: Fix purge command, simplify import and show commands.\n\n* KNOX-3278: Fix ImportCommand and add support for static imports.\n\n* KNOX-3278: Catch Throwable similarly to legacy GroovySh.\n\n* KNOX-3278: Make LoadCommand handle multi-file loading as in legacy GroovySh 4.\n\n* KNOX-3278: wrap GroovyEngine completer into SafeCompleter to handle unexpected exceptions.\n\n* KNOX-3278: correct knoxshell.sh to use launcher and correctly load classes from the lib directory.\n\n* KNOX-3278: fix no endline at end of file.\n\n* KNOX-3278: refactor Shell.java pt1\n\n* KNOX-3278: refactor Shell.java pt2\n\n* KNOX-3238: review findings: keep Launcher because of logging and remove duplicate classpath argument.\n\n* KNOX-3278: review findings: Restore KnoxLoginDialog for credential collection logic.\n\n* KNOX-3278: review findings: Revert LoginCommand to use KnoxLoginDialog.\n\nReverts LoginCommand.execute() to use KnoxLoginDialog for credential collection\ninstead of JLine3 terminal prompts, restoring the Swing GUI popup dialog behavior.\n\nThis maintains consistency with the `:login` command behavior from before KNOX-3278 refactoring, as documented in the original pre-refactor version.\n\n* KNOX-3278: review findings: Replace inline FQN with import\n\n* KNOX-3278: review findings: revert trailing newlines in files that would otherwise not be changed.\n\n* KNOX-3278: review findings: remove override for KnoxShellCommandRegistry.name()\n\n* KNOX-3278: correcting load command to parse filenames with spaces as well\n\n* KNOX-3278: correcting Groovy 5 extension module registration.\n\n* KNOX-3278: Ctrl+C continues back to the prompt; Ctrl+D exits the shell.\n\n* KNOX-3278: review findings: revert trailing newlines in files that would otherwise not be changed.\n\n* KNOX-3278: review findings: fix purge command javadoc and help." }, { "commit": "d0360562e996798722d52ee64a7b5fc48e4c6745", "tree": "3551d5a854c8a558a6a03fc6bb7729b543d9e787", "parents": [ "3c3f3b5e1c9824f225314e022a88f85f8e167b9c" ], "author": { "name": "Raghav Maheshwari", "email": "168407455+Raghav-Mah3shwari@users.noreply.github.com", "time": "Mon Aug 17 12:05:22 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 08:35:22 2026 +0200" }, "message": "KNOX-3394: Correct outdated unittest documentation in Docker Compose integration test README (#1324)\n\nCo-authored-by: Raghav \u003cmaheshwari@Raghavs-MacBook-Air.local\u003e" }, { "commit": "3c3f3b5e1c9824f225314e022a88f85f8e167b9c", "tree": "c919e0f778321443a0d6c487e0b193f5df1b7cc7", "parents": [ "b4b657f6eba5a7347cdacff4b50e8a1a0cd2a49a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Aug 17 08:30:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 08:30:15 2026 +0200" }, "message": "Bump org.apache.httpcomponents.client5:httpclient5 from 5.4.3 to 5.6.3 (#1350)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b4b657f6eba5a7347cdacff4b50e8a1a0cd2a49a", "tree": "12bd72f0337de117e394433a616d5be9b9255031", "parents": [ "f0a5c94d0e6c175234f0e32f8b3ae45aa5cd0886" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Aug 17 08:29:48 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 08:29:48 2026 +0200" }, "message": "Bump org.apache.httpcomponents.core5:httpcore5 from 5.3.6 to 5.4.3 (#1347)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f0a5c94d0e6c175234f0e32f8b3ae45aa5cd0886", "tree": "e4dd8008de6fdd2bdc5cef4d171a1f5e01158fcb", "parents": [ "de71a60cdf34c842abb8a49f770a0e33fe33c7e9" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Aug 14 20:36:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 14 20:36:32 2026 +0200" }, "message": "Knox as an OAuth 2.0 / OpenID Connect Provider (KnoxIDF) (#1351)\n\nApache Knox as an OAuth 2.0 / OpenID Connect Authorization Server. \nSupports the Authorization Code flow (with PKCE for public clients), refresh-token and token-exchange grants, dynamic client registration, a discovery document + JWKS endpoint, and brokered login to external OIDC Providers with persisted federated identities.\n\nIncludes the Trusted OIDC Issuer registry and admin API (KNOX-3355,\nKNOX-3368), gateway-config plumbing (KNOX-3390), and token-exchange\nextensions for dynamic JWKS and issuer attributes (KNOX-3405, KNOX-3408).\n\nSecurity hardening (KNOX-3414) reviewed and tested across the feature:\n\n- Client authentication on every code/refresh redemption — PKCE (S256\n only) or a constant-time client_secret check; no unauthenticated path.\n- Single-use authorization codes and refresh tokens, atomically consumed\n before issuance to close replay/rotation races.\n- Full federated id_token validation (signature, issuer, audience,\n exp/nbf, required sub, and OIDC nonce binding); fail closed on\n misconfiguration.\n- Open-redirect prevention at registration and authorize (HTTPS-only\n except loopback, normalized-path wildcard match, scope whitelist).\n- Secrets at rest via AliasService (fail closed); federated access tokens\n never persisted; consent bound to the initiating subject (POST-only).\n- Secure-by-default flags (anonymous registration, auto-consent), correct\n RFC 6749/6750 error statuses, XSS escaping, structured audit records,\n and signing-key rotation (multi-JWK publication, kid-based verification).\n\nDocumented in a new KnoxIDF book (overview, getting started, endpoint and\nconfiguration reference, security, federation, operations).\n\nCo-authored-by: hsheinblatt \u003chs7@hotmail.com\u003e\nCo-authored-by: Harrison \u003chsheinblatt@cloudera.com\u003e\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e" }, { "commit": "de71a60cdf34c842abb8a49f770a0e33fe33c7e9", "tree": "4d864483e0e888b243e1fa177cd4ac5c71afdd32", "parents": [ "3cb8ef745c44b39377d855d835198de183a4cef3" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Fri Aug 14 13:02:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 14 13:02:59 2026 +0200" }, "message": "KNOX-3418: Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API (#1349)" }, { "commit": "3cb8ef745c44b39377d855d835198de183a4cef3", "tree": "07fea22339eec65fe91ca7d570640230ca9893c9", "parents": [ "c3dee56346cfb2670a114d478db0ba2b51aa01f7" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Fri Aug 14 08:10:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 14 08:10:30 2026 +0200" }, "message": "KNOX-3417: KnoxLdapRealm builds the LDAP search filter from the client username without RFC-4515 escaping (#1348)" }, { "commit": "c3dee56346cfb2670a114d478db0ba2b51aa01f7", "tree": "a19344ddc32f5482c2eeb9f3b38eaf2d8013808b", "parents": [ "5342483a2c7ff229d8819d7df479980753640fc1" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Aug 12 15:26:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 15:26:33 2026 +0200" }, "message": "KNOX-3416: KnoxSSO redirects to untrusted site (#1346)\n\n* KNOX-3416: KnoxSSO redirects to untrusted site\n\n* KNOX-3416: Clarify error message for userInfo" }, { "commit": "5342483a2c7ff229d8819d7df479980753640fc1", "tree": "a04ea58a3f88c58492ce63e2335f4f15d2c21f3a", "parents": [ "049dc0cb894f907efa920a1a2c10fb6ed56fb109" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Wed Aug 12 15:26:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 15:26:22 2026 +0200" }, "message": "KNOX-3413: KnoxToken passcode verification accepts a valid passcode for a different token (#1345)" }, { "commit": "049dc0cb894f907efa920a1a2c10fb6ed56fb109", "tree": "ea36aca0984d7005e2e9659cc1febfe995b5dc3e", "parents": [ "f2126008ab764003e9831e48d30302886be93496" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Tue Aug 11 16:45:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 16:45:59 2026 +0200" }, "message": "KNOX-3411: KnoxToken getUserTokens returns every user\u0027s token metadat… (#1344)\n\n* KNOX-3411: KnoxToken getUserTokens returns every user\u0027s token metadata without a caller authorization check\n\n* KNOX-3411: Add test clean-up" }, { "commit": "f2126008ab764003e9831e48d30302886be93496", "tree": "be4324c9af2c3af15d3a14581767bb701e1523b5", "parents": [ "e51163532f705b1370540f9ce76f68008ff6bd5b" ], "author": { "name": "hanicz", "email": "hanicz@users.noreply.github.com", "time": "Tue Aug 11 16:44:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 16:44:15 2026 +0200" }, "message": "KNOX-3410: KnoxToken enable/disable endpoints perform no caller autho… (#1343)\n\n* KNOX-3410: KnoxToken enable/disable endpoints perform no caller authorization\n\n* KNOX-3410: Address review comments" }, { "commit": "e51163532f705b1370540f9ce76f68008ff6bd5b", "tree": "0b65ec0000bb1aa5baa04d7b2547c3f4255cf9b0", "parents": [ "eb14d8b5d6567a78c7fef4cb414ae1f444f4b6d8" ], "author": { "name": "lmccay", "email": "lmccay@apache.org", "time": "Tue Aug 11 00:14:31 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 00:14:31 2026 -0400" }, "message": "KNOX-3409: Validate knoxauth theme name to Harden Branding Support (Reported by Quinn Nguyen) (#1341)\n\n* KNOX-3409: Validate knoxauth theme name to prevent DOM-based XSS\n\nThe knoxauth login page read the \"theme\" query parameter and wrote it into\na \u003clink\u003e tag via document.write() with no validation, allowing arbitrary\nmarkup injection on the page that collects user credentials. The value was\nalso persisted to localStorage and replayed on later visits, so a single\nmalicious link kept executing on subsequent visits from a clean URL.\n\nTheme names are now validated against ^[a-zA-Z0-9_-]{1,64}$ on every path\n(URL parameter, localStorage, and the configured default), which rejects\nquotes, angle brackets, dots and path separators. The stylesheet element is\nbuilt with DOM APIs instead of string concatenation, so a theme name can\nnever be parsed as markup. A stored value that fails validation, or that\ndoes not resolve to an installed theme, is discarded rather than replayed.\n\nBecause the only URL the loader can produce is styles/themes/\u003cname\u003e/theme.css,\nthe themes actually installed on the server remain the effective allowlist and\nno new configuration is required. The README and deployment guide are updated\nto describe the validation, replacing two security claims that were inaccurate\nas written.\n\nReported by Quinn Nguyen. Not present in any released version - the theming\nfeature (KNOX-3283) has only ever been on master.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* KNOX-3409: Discard an unresolvable theme preference on the same visit\n\nAddresses review feedback. The cleanup flag tracked whether the theme had\nbeen read from localStorage rather than whether it is currently held there.\nA theme supplied via ?theme\u003d is persisted immediately, so it is equally\neligible for cleanup, but the flag stayed false and no onerror handler was\nattached. A name that passed validation without resolving to an installed\ntheme was therefore saved and replayed once before being cleared.\n\nThe flag is renamed to themeIsPersisted and set after a successful\nsetItem, so it reflects the invariant the cleanup actually depends on.\nSetting it inside the try means a failed write - localStorage disabled -\ncorrectly leaves nothing to clean up. Behaviour for an admin-configured\ntheme is unchanged: a deployment error does not discard a user preference.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "eb14d8b5d6567a78c7fef4cb414ae1f444f4b6d8", "tree": "54190a9c003816bff4ae2bd60166368772beb6ee", "parents": [ "e713c58e6cee4ba5e15df67fd46c7a47d48ed08b" ], "author": { "name": "Sandeep Moré", "email": "moresandeep@gmail.com", "time": "Thu Aug 06 09:43:34 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 09:43:34 2026 -0400" }, "message": "KNOX-3407: Support for WebSocket mTLS (#1338)" }, { "commit": "e713c58e6cee4ba5e15df67fd46c7a47d48ed08b", "tree": "e716b8d954bf7c2c8cd07ae4f6d96114ac04e49d", "parents": [ "da08af1f0f44a437d3e9cf3e019215013e2f1df0" ], "author": { "name": "David Han", "email": "handavid@users.noreply.github.com", "time": "Fri Jul 31 09:11:08 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 16:11:08 2026 +0200" }, "message": "KNOX-3386: LDAP Proxy pages backends (#1331)" }, { "commit": "da08af1f0f44a437d3e9cf3e019215013e2f1df0", "tree": "a9c642c5ff0b3417916a4110f402e2f876593b0e", "parents": [ "66575ba66038b27a9c7ae8f92b4e730b0f6e0af3" ], "author": { "name": "Sandor Molnar", "email": "smolnar@apache.org", "time": "Fri Jul 31 07:11:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 07:11:35 2026 +0200" }, "message": "KNOX-3403: RFC 8693 token exchange: use the impersonated subject as the token sub on non-server-managed topologies (#1336)" } ], "next": "66575ba66038b27a9c7ae8f92b4e730b0f6e0af3" }