Skip to content

NemakiWare 3.2.1

Choose a tag to compare

View all tags
@yumioka yumioka released this 03 Jul 02:40
· 852 commits to master since this release
v3.2.1
922aac9

Security-audit remediation + cross-repository tenant isolation + dependency CVEs, plus two post-audit admin-usability additions.

Security — authentication / authorization

  • [High] allowedAuthMethods policy bypass closed on all three remaining password entry points (api/v1 login, MCP Basic/login tool, legacy admin re-auth); a disabled/cloud-only account gets the same generic 401 as a wrong password.
  • Cross-repository tenant isolation: connector-delegation governance and import-profile admin operations are now confined to the authenticated repository (fail-closed); per-repository admins authenticate against their own repository.
  • RAG vector-search repository scoping: all RAG Solr queries scope to repository_id; RAG reader-ACL tokens are now repository-scoped (see Migration).
  • Constant-time session-token comparison on the main path.

Dependencies

  • commons-compress 1.24.0 → 1.27.1 (CVE-2024-25710, CVE-2024-26308); Lucene aligned to 9.12.3 across all modules. npm production deps: 0 vulnerabilities.

Admin usability (post-audit)

  • Runtime-configurable cloud / SSO auth: Google / Microsoft client IDs and Keycloak/OIDC/SAML can be set from the admin menu and persist — the admin-UI value now overrides the deploy-time -D/env bootstrap (a blank value reverts to the deploy default). Previously these fields were locked as "system property".
  • Markdown preview embedded-image resolution: relative image references (images/foo.png, ../assets/a.png) resolve against the document's CMIS folder and stream into a blob URL; unresolved images fall back to alt text + a broken-image indicator. External/data/blob URLs pass through unchanged. HTML files remain a read-only source view (not rendered).

Migration

  • RAG index rebuild required only if RAG semantic search is used — the reader-ACL token format is repository-scoped and intentionally not backward-compatible (fail-closed before rebuild; no cross-repository leak). Affects only the derived RAG Solr index; CouchDB content is untouched.

Upgrade safety

No CouchDB view / patch / persisted-schema / Mango-index change — the 2.4-era CouchDB data carry-over path is untouched.

Verification

TCK 38/38 (clean DB), relevant Java unit 60/60, UI unit (vitest) 191/191, Playwright chromium 911 passed / 102 skipped. Remaining Playwright failures are documented/environmental pre-existing flakies outside the changed code paths.

Full detail: see RELEASE_NOTES.md and CLAUDE.md.

Assets 2
Loading