Updates to latest MSC format and security fix

This release updates the service implementation to the latest state of matrix-org/matrix-spec-proposals#4195. This involved a breaking change on the /get_token Client-Server endpoint where the member object was replaced by a flat member_id parameter. Additionally, the already deprecated delay_timeout parameter was removed from the /delegate_delayed_leave Client-Server endpoint. The service now looks up the delay timeout itself.

Moreover, this version also contains a security fix for the deprecated /get_token and /sfu/get endpoints which were missing proper validation of the OpenID response (GHSA-rq24-fh66-rq7x).

Docker image

The service is available as a Docker image from the GitHub Container Registry.

docker pull ghcr.io/element-hq/lk-jwt-service:0.8.0

Precompiled binaries

The service is available as static precompiled binaries for amd64 and arm64 on linux attached to this release below.

What's Changed

• Demote healthcheck log to debug by @AsilbekKha in #237
• MSC4140: treat 409 from the delayed event management endpoints as final by @barodeur in #239
• Switch C-S and S-S endpoints to use member_id as per the MSC by @Johennes in #241
• Force hidden to false on the JWT by @Johennes in #243
• Remove deprecated delay_timeout parameter by @Johennes in #242
• Check that the remote server is joined before making the federation request by @Johennes in #246
• MSC4140: authenticate delegated delayed leave management calls, and document the appservice requirement by @barodeur in #240

New Contributors

• @AsilbekKha made their first contribution in #237
• @barodeur made their first contribution in #239

Full Changelog: v0.7.0...v0.8.0