dandri/matrix-authentication-service
1
0 Fork 0
mirror of https://github.com/element-hq/matrix-authentication-service.git synced 2026-10-23 06:32:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,930 Commits 89 Branches 115 Tags
ebb9865abe148ec4e5e78a678f6692ef6191f6bc
Commit Graph
7930 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Quentin Gliech ebb9865abe Handle concurrent registrations of identical public clients (#6035) 2026-10-16 11:09:09 +02:00
Quentin Gliech 960584056c Update wasmtime to 49.0.3 to fix RUSTSEC-2026-0353 to RUSTSEC-2026-0364 (#6055) 2026-10-16 10:42:57 +02:00
Quentin Gliech 1081a23591 Update rustls to 0.23.46 to fix RUSTSEC-2026-0346 to RUSTSEC-2026-0349 (#6054) 2026-10-16 09:52:39 +02:00
Quentin Gliech 24c47c38e1 Update wasmtime to 49.0.3 to fix RUSTSEC-2026-0353 to RUSTSEC-2026-0364 2026-10-15 18:20:55 +02:00
Quentin Gliech a1a8146c4e Update rustls to 0.23.46 to fix RUSTSEC-2026-0346 to RUSTSEC-2026-0349 2026-10-15 18:20:55 +02:00
ElementBot 96cec94f3f Automatic merge back to main (#6049) 2026-10-13 23:03:00 +01:00
github-actions[bot] f7917acea9 1.27.0 v1.27.0 2026-10-13 21:46:10 +00:00
Eric Eastwood 0163cd8049 Translations updates for v1.27 (#6048) 2026-10-13 16:44:44 -05:00
github-actions[bot] 7798bb63d2 Translations updates 2026-10-13 21:16:10 +00:00
Quentin Gliech 0b982a2719 Refresh the browser sessions list after removing a browser session (#6042) 2026-10-13 15:21:35 +02:00
Quentin Gliech 3b705d9129 Merge branch 'main' into stefan/browserSessionRefresh 2026-10-13 10:56:45 +02:00
Quentin Gliech 6057e83790 Upgrade ulid to 3.0 (#6039) 2026-10-12 13:32:44 +02:00
Stefan Ceriu a358c7e254 Refresh the browser sessions list after removing a browser session 2026-10-12 09:44:39 +03:00
Quentin Gliech 6b37eb7d74 Upgrade ulid to 3.0 
ulid 3 moves to `rand` 0.10, so it no longer pulls the `rand` 0.9
generation. Only `opentelemetry_sdk` and `sentry` still need it.

ULID generation keeps going through `UlidExt`, whose bit layout matches
ulid's own `from_datetime_with_source`. The only API change affecting
MAS is the rename of `Ulid::new` to `Ulid::generate`, which the clippy
ban list now targets.
 2026-10-09 16:50:36 +02:00
Quentin Gliech 2d3bf03d63 Upgrade to rand 0.10 and the next RustCrypto generation 
`rand` 0.10 and the new RustCrypto generation both build on `rand_core`
0.10, so they have to move together:

 - `rand`, `rand_chacha` and `rand_core` 0.10
 - `digest` 0.11, `sha2` 0.11, `hmac` 0.13, `const-oid` 0.10
 - `elliptic-curve` 0.14, `ecdsa` 0.17, `p256`, `p384` and `k256` 0.14,
   `signature` 3
 - `der`, `spki` and `sec1` 0.8, `pkcs8` 0.11, `pem-rfc7468` 1.0
 - `rsa` 0.10.0-rc.19 and `pkcs1` 0.8.0-rc.5, which have no stable
   release yet. They are pinned exactly, because release candidates
   break their API between releases.
 - `argon2` 0.6 and `pbkdf2` 0.13

On the `rand` side, `RngCore` becomes `Rng` and the old `Rng` becomes
`RngExt`. `gen_*` becomes `random_*`, `thread_rng` becomes `rng`,
`distributions` becomes `distr`, and `from_rng` can no longer fail. On
the crypto side, `mas-jose` and `mas-keystore` move to `BoxedUint` for
RSA, to the `pkcs1` and `pkcs8` reference types, and to the `Generate`
trait for key generation, and `mas-jose` no longer depends on
`generic-array`. Password hashing goes through `hash_password_with_rng`.

Stored data is unaffected. The password hashing snapshots are unchanged,
so bcrypt, Argon2 and PBKDF2 produce the same hashes for the same input
and salt, and `pbkdf2` 0.13 keeps the same defaults (SHA-256, 600 000
rounds). The keystore snapshots change only because keys generated from
a seeded RNG differ. The snapshots of keys loaded from files are
unchanged.

`opa-wasm` 0.3.3 already uses this generation, so most of the duplicate
crates it pulled in go away. The `deny.toml` skip list now names what
still pulls the older versions: cookie, sqlx, headers, wasmtime and pest
for RustCrypto, and opentelemetry_sdk, sentry and ulid for `rand` 0.9.
 2026-10-09 15:42:26 +02:00
Quentin Gliech 9f40244eab Bump chacha20poly1305 from 0.10 to 0.11 
It moves from `generic-array` to `hybrid-array`, so `Encrypter` builds
its key and nonce with the `Key` and `Nonce` aliases, and `mas-keystore`
no longer depends on `generic-array`. Cookie (via `aes-gcm`) is still on
`aead` 0.5, so the older `aead` and `universal-hash` go on the cargo-deny
skip list.
 2026-10-09 15:38:53 +02:00
Quentin Gliech f8b7c5b879 Bump bcrypt from 0.18 to 0.19 
The hashes it produces are unchanged. It pulls `blowfish` 0.10, which is
on `cipher` 0.5 while the rest of the tree is on 0.4, so the older
`cipher` and `inout` go on the cargo-deny skip list.
 2026-10-09 15:38:53 +02:00
Quentin Gliech 9659701f7a Bump rand from 0.8.5 to 0.8.6 to address RUSTSEC-2026-0097 
0.8.6 is the patched release for the `rand::thread_rng` unsoundness with
custom loggers, so the advisory ignore is no longer needed.
 2026-10-09 15:38:52 +02:00
Quentin Gliech 186c592d61 Allow the duplicate crates pulled in by opa-wasm 0.3 and the icu bump 
The `cargo deny` bans check fails on main because two dependency bumps
introduced duplicate crate versions:

 - `opa-wasm` 0.3.3 (#6029) uses `rand` 0.10, `base64` 0.23 and the
   `digest` 0.11 generation of the RustCrypto crates, while the rest of
   the tree is still on `rand` 0.9, `base64` 0.22 and `digest` 0.10.
 - The icu bump (#6015) pulls `zerovec-derive` 0.11.6, which uses `syn` 3,
   while everything else is on `syn` 2.

Add the older versions to the skip list until the rest of the tree
catches up.
 2026-10-09 15:26:05 +02:00
Quentin Gliech 03b4eba347 Handle concurrent registrations of identical public clients 
Two registrations with the same metadata could both miss the `find_by_metadata_digest` lookup and then race on the insert, the loser failing with a unique violation on `oauth2_clients_metadata_digest_key` and getting a 500.

`OAuth2ClientRepository::add` becomes `add_or_reuse` and inserts with `ON CONFLICT (metadata_digest) DO UPDATE ... RETURNING`, which yields the existing client when the digest is taken, including one committed while the insert was waiting on it. It reports whether it inserted, so the registration handler drops its lookup and still tells created and reused clients apart in the metric. `find_by_metadata_digest` has no callers left and is removed.

The returned client is now built from the database row, so it carries the metadata digest instead of always `None`, and the span records the id of the client actually returned.
 2026-10-09 14:55:11 +02:00
Olivier 'reivilibre 2277a37c59 Remove the "Application Services login" warning page (#5962) 2026-10-09 11:18:08 +01:00
Eric Eastwood 1968992f16 Automatic merge back to main (#6031) 2026-10-06 11:44:51 -05:00
github-actions[bot] 912bcf2192 1.27.0-rc.0 v1.27.0-rc.0 2026-10-06 15:50:28 +00:00
Eric Eastwood 5a78ee96cd Translations updates for main (#6030) 2026-10-06 10:49:04 -05:00
github-actions[bot] 15e27bed51 Translations updates 2026-10-06 15:13:57 +00:00
Andrew Morgan eb834276cb Bump opa-wasm from 0.2.0 to 0.3.3, wasmtime from 43.0.2 to 49.0.2 (#6029) 2026-10-06 16:02:50 +01:00
Andrew Morgan f2006bb30c Bump wasmtime from 43.0.2 to 49.0.2 
This silences
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c,
even though MAS was not affected (as the `component-model-async` feature
was not enabled).

The command used to update was:

```
cargo update -p wasmtime --precise 49.0.2
```
 2026-10-06 14:55:22 +01:00
Andrew Morgan e783c76030 Bump opa-wasm from 0.2.0 to 0.3.3 2026-10-06 14:41:22 +01:00
Olivier 'reivilibre 357cd68ad5 Allow password reset while signed in (#5985) 
Users can have an ambient login whilst not knowing their password.

This is also an easily-hit path when upgrading an SSO account to have a password.
 2026-10-06 11:04:19 +01:00
Olivier 'reivilibre 6cb3a49016 Properly limit number of jobs that can be fetched (#6006) 2026-10-05 16:39:03 +01:00
Olivier 'reivilibre 99ee247654 build(deps-dev): bump storybook from 10.5.3 to 10.6.0 in the storybook group across 1 directory (#6017) 2026-10-05 16:37:31 +01:00
dependabot[bot] c8fb006cfa build(deps-dev): bump storybook 
Bumps the storybook group with 1 update in the / directory: [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core).


Updates `storybook` from 10.5.3 to 10.6.0
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.6.0/code/core)

---
updated-dependencies:
- dependency-name: storybook
  dependency-version: 10.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: storybook
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-05 11:44:30 +00:00
Olivier 'reivilibre 6ad02e32c3 build(deps-dev): bump the vite group across 1 directory with 2 updates (#6019) 2026-10-05 12:38:57 +01:00
dependabot[bot] d5a61a46e1 build(deps-dev): bump the vite group across 1 directory with 2 updates 
Bumps the vite group with 2 updates in the / directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@vitejs/plugin-react` from 6.0.4 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `vite` from 8.1.5 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: vite
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: vite
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-05 11:14:48 +00:00
Olivier 'reivilibre 57f1314889 build(deps): bump the fontsource group across 1 directory with 2 updates (#6018) 2026-10-05 12:10:33 +01:00
Olivier 'reivilibre 83e8d41dab build(deps): bump the i18next group across 1 directory with 3 updates (#6020) 2026-10-05 12:10:03 +01:00
dependabot[bot] ab359fd4cf build(deps): bump the fontsource group across 1 directory with 2 updates 
Bumps the fontsource group with 2 updates in the / directory: [@fontsource/inconsolata](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/inconsolata) and [@fontsource/inter](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/inter).


Updates `@fontsource/inconsolata` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/inconsolata)

Updates `@fontsource/inter` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/inter)

---
updated-dependencies:
- dependency-name: "@fontsource/inconsolata"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: fontsource
- dependency-name: "@fontsource/inter"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: fontsource
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-05 10:18:47 +00:00
dependabot[bot] 30c3077f78 build(deps): bump the i18next group across 1 directory with 3 updates 
Bumps the i18next group with 3 updates in the / directory: [i18next](https://github.com/i18next/i18next), [react-i18next](https://github.com/i18next/react-i18next) and [i18next-cli](https://github.com/i18next/i18next-cli).


Updates `i18next` from 26.3.6 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v26.3.6...v26.4.2)

Updates `react-i18next` from 17.0.10 to 17.0.14
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v17.0.10...v17.0.14)

Updates `i18next-cli` from 1.66.2 to 1.74.1
- [Changelog](https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next-cli/compare/v1.66.2...v1.74.1)

---
updated-dependencies:
- dependency-name: i18next
  dependency-version: 26.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: i18next
- dependency-name: i18next-cli
  dependency-version: 1.74.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: i18next
- dependency-name: react-i18next
  dependency-version: 17.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: i18next
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-05 10:18:27 +00:00
Olivier 'reivilibre ee29e7e8b1 build(deps): bump icu_locale_core from 2.2.0 to 2.3.0 in the icu group (#6015) 2026-10-05 11:16:55 +01:00
Olivier 'reivilibre ebb172b2ce build(deps): bump opentelemetry-resource-detectors from 0.11.0 to 0.12.0 in the opentelemetry group (#6012) 2026-10-05 11:16:17 +01:00
Olivier 'reivilibre c02a892e4f build(deps): bump mozilla-actions/sccache-action from 0.0.10 to 0.0.11 (#6011) 2026-10-05 11:16:05 +01:00
Olivier 'reivilibre 8e00712647 build(deps): bump tailscale/github-action from 4.1.2 to 4.2.0 (#6010) 2026-10-05 11:15:51 +01:00
Olivier 'reivilibre 3c38f410e7 build(deps): bump docker/bake-action from 7.2.0 to 7.4.0 (#6008) 2026-10-05 11:15:34 +01:00
Olivier 'reivilibre d100abd997 build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 (#6007) 2026-10-05 11:15:19 +01:00
Olivier 'reivilibre 2dc4fff90f build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 (#6009) 2026-10-05 11:15:07 +01:00
Olivier 'reivilibre 38beccd9a3 build(deps): bump regex from 1.12.4 to 1.13.1 (#6016) 2026-10-05 11:14:09 +01:00
Olivier 'reivilibre 470a56de4b build(deps): bump the react group with 2 updates (#6021) 2026-10-05 11:13:29 +01:00
dependabot[bot] 4b3e5a7191 build(deps): bump the react group with 2 updates 
Bumps the react group with 2 updates: [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom).


Updates `react` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: react
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: react
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 14:13:21 +00:00
dependabot[bot] 1234b79c6f build(deps): bump regex from 1.12.4 to 1.13.1 
Bumps [regex](https://github.com/rust-lang/regex) from 1.12.4 to 1.13.1.
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/regex/compare/1.12.4...1.13.1)

---
updated-dependencies:
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 13:57:21 +00:00
dependabot[bot] 3322631445 build(deps): bump icu_locale_core from 2.2.0 to 2.3.0 in the icu group 
Bumps the icu group with 1 update: [icu_locale_core](https://github.com/unicode-org/icu4x).


Updates `icu_locale_core` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/unicode-org/icu4x/releases)
- [Changelog](https://github.com/unicode-org/icu4x/blob/main/CHANGELOG.md)
- [Commits](https://github.com/unicode-org/icu4x/compare/icu@2.2.0...icu@2.3.0)

---
updated-dependencies:
- dependency-name: icu_locale_core
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: icu
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 13:57:09 +00:00