Tags: aegif/NemakiWare
Tags
NemakiWare 3.2.5 Input-robustness & concurrency hardening from exploratory fuzzing: - [Medium] Concurrent same-name create no longer duplicates (per-parent write lock) - [Medium] Full-text CONTAINS() with special chars no longer 500s (Solr escaping) - [Medium] MCP non-object JSON-RPC params no longer 500s - [Low] Malformed import archive -> 400; over-long RAG query -> 400 Ships tools/test-env/monkey fuzz harness. No schema/persistence changes.
NemakiWare 3.2.4
- [High, UI] Fix intermittent document-list crash on folder navigation
("Failed to execute 'insertBefore' on 'Node'") by keying the Ant Table
per folder/search view. Production-build-only rc-table reconciliation
glitch; verified 30/30 clean navigations (was ~1/6 crash).
UI-only fix; no server / API / schema changes.
NemakiWare 3.2.3
- [High] Nested group membership now grants permissions (view array-key
fix + ACLExpander nested-groups traversal + group-create cache
invalidation)
- [High] ACL changes no longer destroy RAG search chunks (full block
rebuild from stored fields, single-add replacement, striped locks)
- [Medium] Ranged getContentStream no longer misreports Content-Length
(TCK ContentRangesTest / "Premature EOF")
- New: tools/test-env permission-diversity / vector-search / MCP demo
seeding tool
Upgrade note: deployments that changed ACLs on RAG-indexed folders
before this release should run
POST /api/v1/cmis/repositories/{repo}/search-engine/rag/reindex once.
QA: TCK effectively 38/38, Playwright chromium 938 passed / 92 skipped,
QA integration 94/94, RAG package 306/306, live grant/revoke verification.
NemakiWare 3.2.2 Codex security-review remediation + E2E flaky-test stabilization (off v3.2.1). Security: - [Medium] PlantUML/DOT rendition forced to the SANDBOX profile (no local file read, no network includes) + source-size / render-time / output-size limits. - [Medium] Archive import applies archive-supplied ACLs only for admins/system restores (non-admin import keeps the inherited ACL) — closes a CAN_APPLY_ACL bypass; same guard added to the filesystem-import path. - [Low] HTTPS connect-only DNS-rebinding residual re-affirmed (data-exchange SSRF already closed by TLS; full fix deferred). Test: 7 pre-existing flaky Playwright specs hardened. Verified: TCK 38/38 (clean DB), Java unit 130/130, UI vitest 191/191, security regression + live PoC. Full Playwright 926-933 passed / 99 skipped with a small run-varying intermittent-flaky tail deferred to a separate test-infra effort. No CouchDB view/patch/schema/Mango change — 2.4-era data carry-over preserved.
NemakiWare 3.2.1 Security-audit remediation + cross-repository isolation + dependency CVEs, plus post-audit admin-usability additions: - runtime-configurable Google/Microsoft/OIDC(Keycloak)/SAML auth from the admin menu (admin-UI value overrides the deploy -D/env bootstrap, persists) - Markdown preview embedded-image resolution against the CMIS folder Verified: TCK 38/38 (clean DB), Java unit 60/60, UI vitest 191/191, Playwright chromium 911 passed / 102 skipped (remaining failures are documented/environmental flakies outside the changed paths). No CouchDB view/patch/schema/Mango change (2.4-era carry-over preserved).
v3.1.1-RC6.13 — Test quality: feature-readback now binds to productio… …n reader (closes RC6.12 P3) Test-quality follow-up to RC6.12. Production SAXReader configuration unchanged (byte-equivalent — three setFeature calls just split into a new configureHardenedSaxReader() helper that parseAcpPackageXml now delegates to). Closes RC6.12 external review P3: feature-readback assertion was inspecting a test-local probe, not the production-configured reader. Restructured so the readback queries ZipImporter.configureHardenedSaxReader() directly. 3-way mutation test verified: each of the three setFeature lines, removed in isolation, fails the matching readback assertion. Disallow-doctype removal additionally fails the 2 DOCTYPE-rejection cases. After restore: 4/4 PASS. Tests: ZipImporterXxeTest 4/4 PASS, focused 25-class regression 377/377 PASS (same count as RC6.12), SOC validator 17 PASS / 7 SKIP, NUL scan 1681 source files / 0 hits. No public API change. No property change. No schema / patch / view / Mango / migration change. Operators see zero behavioural difference. RC6.11 GHSA XXE security boundary is unchanged; RC6.12 production path behaviour is unchanged. Base: v3.1.1-RC6.12 (peeled f8ec032).
PreviousNext