Repository navigation
Release PR - #599
Open
ryanbas21 wants to merge 18 commits into
Open
Release PR#599ryanbas21 wants to merge 18 commits into
ryanbas21 wants to merge 18 commits into
Conversation
docs: update sample app links to correct sdk-sample-apps paths
chore(context): convert CLAUDE.md to @AGENTS.md import chore(context): add GEMINI.md redirect to AGENTS.md chore(context): convert copilot-instructions.md to AGENTS.md redirect chore(context): fix redirect files and gitignore for forgerock repo chore(context): fix AGENTS.md note and token-vault dir tree
…SDKS-5448) The three token-carrying branches (token exchange, revoke, end session) keep keyword detection but fetch vault-composed URLs from generateAmUrls instead of the attacker-supplied request URL, so tokens can never be routed to attacker-chosen destinations. Adds a userinfo branch (composed URL, Bearer header), denies other AM-origin requests with an explicit error reply, and composes id_token_hint onto the vault's endSession URL. Adds e2e edge-case coverage to token-vault-suites covering endpoint-name in query strings and percent-encoded endpoint paths. No percent-decoding required.
fix(token-vault): compose vault-owned AM URLs for endpoint dispatch (SDKS-5448)
fix(token-vault): reliably end the AM SSO session on logout (SDKS-5448)
chore: fix - upgrade nx - fix ci - fix node issues and upgrade to node 24
Add missing changeset and update node version to 22
|
View your CI Pipeline Execution ↗ for commit c08de5f
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
commit: |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #599 +/- ##
==========================================
- Coverage 56.72% 56.58% -0.15%
==========================================
Files 105 105
Lines 28457 28534 +77
Branches 1644 1644
==========================================
+ Hits 16143 16145 +2
- Misses 12314 12389 +75 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ci: add mend scan workflow for releases
github-actions
Bot
force-pushed
the
changeset-release/master
branch
from
October 21, 2026 17:25
c08de5f to
33ed3e2
Compare
fix(token-vault): allow requests to resource server endpoints similar to AM endpoints
github-actions
Bot
force-pushed
the
changeset-release/master
branch
from
October 21, 2026 22:16
33ed3e2 to
e196fc1
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.
Releases
@forgerock/token-vault@4.2.3
Patch Changes
#598
de96cf6Thanks @ancheetah! - Allow requests to resource server endpoints similar to AM endpoints to preserve backwards compatibility#595
11ac633Thanks @vatsalparikh! - Add sessions/ endpoint to fully complete logout#597
85e2cc9Thanks @ancheetah! - Compose AM request URLs from config to prevent attacker-supplied request URLs