dunglas/mercure v1.1.4 on GitHub

Community

Mercure 1.1.4 closes two authorization gaps, and includes the changes tagged in 1.1.3. Compatibility mode now relaxes token checks only for 0.x clients, so a JWT from a shared issuer, such as an OpenID Connect ID token, no longer gets past disabled anonymous access, and 0.x history replay through lastEventID works again. The per-token subscription limit can no longer be bypassed by re-encoding a token's signature. The Helm chart can also terminate TLS in the pod, keeping HTTP/2 end-to-end and adding HTTP/3. Read the upgrade notes before upgrading a hub running protocol_version_compatibility.

🐛 Bug Fixes

Compatibility mode: scope protocol_version_compatibility to 0.x clients. Only tokens carrying a mercure claim and no authorization_details skip the RFC 9068 checks (typ, exp, aud, iss); before, any token without authorization_details skipped them. 1.x tokens are rejected in the authorization query parameter and the mercureAuthorization cookie, subscribe requests mixing 0.x parameters with match or match_* get a 400, and replay through the 0.x lastEventID parameter is restored. Under protocol_version_compatibility 7, publishing public updates to ungranted topics requires a legacy mercure.publish claim. A 0.x token with no mercure claim is now rejected: add "mercure": {} to keep it working. Fixes #1443. by @dunglas in #1444
Compatibility mode: keep accepting last_event_id beside topic, as 1.0 to 1.1.2 did, instead of answering with a 400. Browser clients send this combination, and it is their only way to replay history under protocol_version_compatibility 8. The hub logs a deprecation notice: switch these clients to match. by @dunglas in #1456
Subscriber limits: key the per_token subscription limit on the signed header.payload part instead of the raw token. Flipping the unused bits of a signature's last base64url character, or using the second valid ECDSA signature (s and n-s), let one token open more streams than allowed. by @dunglas in #1445

✨ New Features

Helm chart: serve HTTPS and HTTP/3 from the pod, for instance behind an OpenShift passthrough route. New values: extraVolumes and extraVolumeMounts to mount certificates, service.portName (an https name switches the test pod and notes to HTTPS), service.http3 to expose the port over UDP, and metricsService.annotations. The legacy /healthz probes are gone, since the hub no longer serves this route: with healthCheck.enabled: false, the pod has no probes. See Serving HTTPS from the pod. by @jza0330 in #1294

Enterprise

Mercure Enterprise picks up the same fixes in image v1.1.4, along with updated dependencies. Mercure Cloud hubs are upgraded automatically: use Mercure Cloud to get fixes like these without managing upgrades yourself.

Enterprise releases ship under the Enterprise SLA, with prioritized patches and direct support. Contact contact@mercure.rocks for the managed Cloud offering, on-premise licenses, custom development, consulting, and training.

💖 New Contributors

@jza0330 made their first contribution in #1294

Full Changelog: v1.1.2...v1.1.4