Merge branch 'chore/changelog-dsh-v0.2.1-rc.5-r6' into fix/security-gateway-sessions

Signed-off-by: Nicolás Georger <info@sredevops.org>
chore(changelog): refresh for dsh-v0.2.1-rc.5-r6
2026-11-03 01:13:24 +00:00 · 2026-10-31 07:38:56 -03:00 · 2026-10-31 09:31:08 +00:00 · 2026-10-31 00:55:39 -03:00 · 2026-10-31 00:54:05 -03:00
2 changed files with 9 additions and 3 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@
 All notable changes to this repository are documented here.
 Generated by git-cliff from Conventional Commits; do not edit this file by hand.
-## [Unreleased]
+## [dsh-v0.2.1-rc.5-r6] - 2026-10-31
 ### Added
@@ -30,8 +30,7 @@ Generated by git-cliff from Conventional Commits; do not edit this file by hand.
 - **changelog:** Refresh for dsh-v0.2.1-rc.5 (#30) (b57916d)
 - Bump docker/login-action (#28) (8c34f43)
 - **deps:** Bump agent-sandbox to v1.0.9 (#38) (4c073ee)
- **dockerfile:** Improve package installation and add Python dependencies (bd7c6f3)
+- Improve package installation and add Python depend… (#42) (8e9bd47)
 - **dockerfile:** Update package installation commands for consistency (0a3fe25)
 ### Other
--- a/versions.env
+++ b/versions.env
@@ -29,6 +29,13 @@ NODE_RUNTIME_IMAGE=docker.io/node:24-trixie-slim@sha256:54f84b4cf8432b21aaffd5d3
 # Base image for the example gateway (examples/dsh-agents-as-a-service/gateway).
 GATEWAY_PYTHON_IMAGE=docker.io/python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159
 # Base images for the main DSH Web image (root Dockerfile), pinned by digest.
 NODE_BUILD_IMAGE=docker.io/node:24-trixie@sha256:8c761eca2bf7eec965f946cf47b8090143cb41f45f2f8699af0cc0298d2d2d19
 NODE_RUNTIME_IMAGE=docker.io/node:24-trixie-slim@sha256:54f84b4cf8432b21aaffd5d3ce8d41e12cea0d10d33c09d2f3c9879d49d6b446
 # Base image for the example gateway (examples/dsh-agents-as-a-service/gateway).
 GATEWAY_PYTHON_IMAGE=docker.io/python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159
 # Control-plane versions used by the examples and their manifests.
 # The matching SHA-256s pin the release manifests that CI downloads and
 # applies; update both the version and the digest when bumping either pin.
Author	SHA1	Message	Date
Nicolás Georger	f4c0b52ee9	Merge branch 'chore/changelog-dsh-v0.2.1-rc.5-r6' into fix/security-gateway-sessions Signed-off-by: Nicolás Georger <info@sredevops.org>	2026-10-31 07:38:56 -03:00
github-actions[bot]	96837a43b6	chore(changelog): refresh for dsh-v0.2.1-rc.5-r6	2026-10-31 09:31:08 +00:00
SREDevOpsAgents	2eb5c82ace	Merge remote-tracking branch 'origin/main' into fix/security-gateway-sessions # Conflicts: # docs/versioning.md # versions.env	2026-10-31 00:55:39 -03:00
SREDevOpsAgents	ae8aba8241	fix(gateway)!: replace token cookies with revocable sessions and harden abuse controls - Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.	2026-10-31 00:54:05 -03:00