Ruben FiszelandClaude Opus 4.8 072d866e78 fix: bound every dimension of the JWKS cache (URL, key count, key bytes) ...

The retained-bytes cap left two dimensions unbounded that reviewers named: the
cache keys on the admin-supplied URL (unbounded TEXT column), and the per-key
fixed cost (many tiny keys serialize small but each Jwk and its map slot cost
memory). Add a URL-length cap in fetch_jwks (the choke point save validates
through, so an overlong URL is never stored or cached) and a usable-key count
cap alongside the retained-bytes cap, both measured after filtering so a mixed-
use set is judged by its signing keys. Every dimension is now bounded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 15:51:59 +02:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: bound every dimension of the JWKS cache (URL, key count, key bytes)

2026-09-04 15:51:59 +02:00

tests

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

Cargo.toml

fix: accept any PEM wrapping for the guest key, keep the public-key check

2026-09-04 10:30:46 +02:00