Ruben FiszelandClaude Opus 4.8 7d3a9fd5cd fix: bound a JWKS cache entry by key count, not only bytes ...

JWKS_MAX_BYTES caps one response and the cache caps entry count (200), but a
densely packed 1 MiB body parses into thousands of keys, so one entry could
retain a few MB and a workspace admin rotating URLs could grow the shared
process by hundreds of MB. Refuse a set larger than JWKS_MAX_KEYS (50) in
parse_jwks_keys, which bounds retention at the source; real issuers publish a
handful of keys.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 15:19:42 +02:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: bound a JWKS cache entry by key count, not only bytes

2026-09-04 15:19:42 +02:00

tests

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

Cargo.toml

fix: accept any PEM wrapping for the guest key, keep the public-key check

2026-09-04 10:30:46 +02:00