Access control#
Machine tokens require secret access to carry project grants. Creating a machine token with project grants, or re-displaying one, now requires secret.write alongside token.write. This matches the requirement already in place for granting a machine access to a project directly. Tokens without project grants continue to require token.write only.
Encryption keys#
Master key rotation covers every encrypted item. Rotation now re-wraps the backup passphrase, IP data credentials, and stored machine invitations and tokens alongside secret values. Before completing, a rotation confirms that nothing remains on a previous key generation, and stops without changes if anything does.
Rotation is coordinated with writes in progress. A secret written while a rotation is running is now covered by that rotation.
Backups#
Backups are captured from a single database snapshot. Every table is read at one point in time and paired with the master keyring in effect at that moment.
Verification confirms an archive can be restored. Verifying a backup now checks that the keyring in the archive covers the secrets stored in it, in addition to the passphrase and archive integrity.
Verification limits. Archives larger than 256 MB are declined before being read, and verifications run two at a time.
File handling. Backup and log downloads resolve to the target file and confirm it sits within the configured directory. The writability check for a backup directory now creates a uniquely named file exclusively and removes only that file.
Database#
Bundled PostgreSQL updated to 16.15. Existing data directories are read in place and no action is required.
Durability settings are explicit. The bundled PostgreSQL runs with fsync, synchronous commit, and full page writes enabled, and confirms these at every start.
Connections are loopback only. The bundled PostgreSQL accepts connections over the loopback interface with authentication required.
Remote access#
Rate limiting for relayed requests. Requests arriving through the RatelKey relay are rate limited against the connecting client's address.
Connection limits. The relay applies per-source and overall limits on concurrent connections. Burrows apply a limit on concurrent relayed streams and a deadline for completing TLS.
Dependencies#
Netty updated to 4.1.137.