From a9b5191288ada25475e75bd8afbad94ca8bdd01f Mon Sep 17 00:00:00 2001 From: Max Lambrecht Date: Sat, 8 Aug 2026 14:08:37 -0500 Subject: [PATCH] chore(release): prepare release 0.9.0 Signed-off-by: Max Lambrecht --- CHANGELOG.md | 37 ++++++++++++++++++++++++++++++++++++ README.md | 20 +++++++++---------- gradle.properties | 2 +- java-spiffe-helper/README.md | 4 ++-- 4 files changed, 50 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 95be1b1a..0af1010c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,42 @@ # Changelog +## [0.9.0] - 2026-08-11 + +### Breaking changes + +* `RetryHandler.scheduleRetry(Runnable)` now returns `boolean` instead of `void` to indicate whether a retry was scheduled. + This is source-compatible but binary-incompatible, so existing 0.8.x-compiled artifacts must be rebuilt (#436) + +### Changed + +* Registering a watch on a closed `WorkloadApiClient` now throws `IllegalStateException` instead of being accepted (#435) +* X.509-SVID and JWT-SVID validation is stricter and rejects material that earlier versions accepted. See the + fixes below for details + +### Fixed + +* Validate the peer certificate chain against the trust bundle before invoking `SpiffeIdVerifier` (#449) +* Enforce the X.509-SVID leaf profile when validating SVID certificates (#433) +* Harden SPIFFE URI SAN parsing when extracting SPIFFE IDs from certificates (#434) +* Reject empty JWT-SVID audience values (#431) +* Publish JWT bundle updates safely to avoid torn reads (#429) +* Refresh cached JWT-SVIDs that do not carry an `iat` claim (#430) +* Reject new watches after the Workload API client is closed (#435) +* Notify watchers when retries stop instead of failing silently (#436) +* Preserve sub-second retry delays in the retry handler (#432) +* Preserve multiple X.509 bundle authorities in the helper KeyStore (#428) + +### Dependency updates + +* Bump grpcVersion from 1.80.0 to 1.83.1 (#427, #440, #442, #446, #453) +* Bump com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1 (#438) +* Bump commons-validator:commons-validator from 1.10.1 to 1.11.0 (#455) +* Bump com.google.protobuf from 0.9.6 to 0.10.0 (#425) +* Bump com.vanniktech.maven.publish from 0.35.0 to 0.37.0 (#445) +* Bump gradle-wrapper from 9.4.1 to 9.6.1 (#426, #437, #443) +* Bump the github-actions group with 2 updates (#441) + + ## [0.8.17] - 2026-04-20 ### Fixed diff --git a/README.md b/README.md index 75d0d9c5..717db28d 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ X.509 and JWT SVIDs and bundles. Download -------- -The JARs can be downloaded from [Maven Central](https://search.maven.org/search?q=g:io.spiffe%20AND%20v:0.8.17). +The JARs can be downloaded from [Maven Central](https://search.maven.org/search?q=g:io.spiffe%20AND%20v:0.9.0). The dependencies can be added to `pom.xml` @@ -35,7 +35,7 @@ To import the `java-spiffe-provider` component: io.spiffe java-spiffe-provider - 0.8.17 + 0.9.0 ``` The `java-spiffe-provider` component imports the `java-spiffe-core` component. @@ -45,7 +45,7 @@ To just import the `java-spiffe-core` component: io.spiffe java-spiffe-core - 0.8.17 + 0.9.0 ``` @@ -53,12 +53,12 @@ Using Gradle: Import `java-spiffe-provider`: ```gradle -implementation group: 'io.spiffe', name: 'java-spiffe-provider', version: '0.8.17' +implementation group: 'io.spiffe', name: 'java-spiffe-provider', version: '0.9.0' ``` Import `java-spiffe-core`: ```gradle -implementation group: 'io.spiffe', name: 'java-spiffe-core', version: '0.8.17' +implementation group: 'io.spiffe', name: 'java-spiffe-core', version: '0.9.0' ``` ### MacOS Support @@ -72,14 +72,14 @@ In case run on a osx-x86 architecture, add to your `pom.xml`: io.spiffe grpc-netty-macos - 0.8.17 + 0.9.0 runtime ``` Using Gradle: ```gradle -runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos', version: '0.8.17' +runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos', version: '0.9.0' ``` #### Aarch64 (M1) Architecture @@ -91,7 +91,7 @@ If you are running the aarch64 architecture (M1 CPUs), add to your `pom.xml`: io.spiffe grpc-netty-macos-aarch64 - 0.8.17 + 0.9.0 runtime ``` @@ -99,7 +99,7 @@ If you are running the aarch64 architecture (M1 CPUs), add to your `pom.xml`: Using Gradle: ```gradle -runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos-aarch64', version: '0.8.17' +runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos-aarch64', version: '0.9.0' ``` *Caveat: not all OpenJDK distributions are aarch64 native, make sure your JDK is also running @@ -112,7 +112,7 @@ The `java-spiffe-helper` module manages X.509 SVIDs and Bundles in Java Keystore ### Docker Image -Pull the `java-spiffe-helper` image from `ghcr.io/spiffe/java-spiffe-helper:0.8.17`. +Pull the `java-spiffe-helper` image from `ghcr.io/spiffe/java-spiffe-helper:0.9.0`. For more details, see [java-spiffe-helper/README.md](java-spiffe-helper/README.md). diff --git a/gradle.properties b/gradle.properties index c5ea6457..68b492f2 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1 +1 @@ -version=0.8.17 +version=0.9.0 diff --git a/java-spiffe-helper/README.md b/java-spiffe-helper/README.md index 3ed13e88..9d6d73b6 100644 --- a/java-spiffe-helper/README.md +++ b/java-spiffe-helper/README.md @@ -10,11 +10,11 @@ The Helper automatically gets the SVID updates and stores them in the KeyStore a On Linux: -`java -jar java-spiffe-helper-0.8.17-linux-x86_64.jar` +`java -jar java-spiffe-helper-0.9.0-linux-x86_64.jar` On Mac OS: -`java -jar java-spiffe-helper-0.8.17-osx-x86_64.jar` +`java -jar java-spiffe-helper-0.9.0-osx-x86_64.jar` You can run the utility with the `-c` or `--config` option to specify the path to the configuration file. By default, it will look for a configuration file named `conf/java-spiffe-helper.properties` in the current working directory.