fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups by waleedlatif1 · Pull Request #9870 · simstudioai/sim

fix(api): tell a missing key owner from an owner whose ban state is null

waleedlatif1

committed

587d3a3

fix(credentials): report a refused connection host as host_not_allowed

waleedlatif1

committed

5e07f86

fix(credentials): report an oversized Databricks token success as a 502

waleedlatif1

committed

ba17d53

docs(api): say v2 execute options need a full-access key or api:write

waleedlatif1

committed

b5206f6

chore(scripts): scope the payload-param allowlist to internal operations

waleedlatif1

committed

894ab56

fix(redaction): keep Infisical secret names visible; redact only deployKey

waleedlatif1

committed

cc7816b

docs(networking): the SSRF guard matches NO_PROXY like curl, not like Bun

waleedlatif1

committed

d3d4d9b

fix(api-keys): never echo an internal key-creation failure to the caller

waleedlatif1

committed

49ef21a

chore: log a failed route-cache clear and spell out the read-only key rollback

waleedlatif1

committed

f0c91fa

fix(credentials): release saved secrets only to internal-JWT callers

waleedlatif1

committed

03e0b90

fix(firecrawl): treat a blank maxDiscoveryDepth as unset

waleedlatif1

committed

65dec86

chore(credentials): log a broken JWKS and keep the successor map out of credential display

waleedlatif1

committed

8369595

test: drop or tighten assertions that could not fail

waleedlatif1

committed

9fcf4a2

fix(security): ignore a malformed CIDR NO_PROXY entry

waleedlatif1

committed

d45b05d

chore(workflows): scope the paused-row read to its workflow and reuse the mutability guard

waleedlatif1

committed

e1b532e

fix(credentials): never name a sibling credential in a trust-setup refusal

waleedlatif1

committed

eb276fb

docs: correct the Helm readOnlyRootFilesystem note and the deployed-run variables TSDoc

waleedlatif1

committed

3d3a9c9

test(credentials): rely on the shared env reset in the proxy validator tests

waleedlatif1

committed

36450c5

chore(helm): bump the chart version for the README correction

waleedlatif1

committed

5a84548

fix(redaction): keep prefixed secret keys masked while leaving Infisical's bare secretKey visible

waleedlatif1

committed

397444b

fix(release): keep bare secretKey redacted, leave the proxy every-address rule to the transport, and report unknown GitLab hosts as input errors

waleedlatif1

committed

17cf2df

Navigation Menu

Repository navigation

fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups - #9870

fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups#9870
waleedlatif1 merged 21 commits into
stagingfrom
fix/release-final-leftovers-1110

Commits on Nov 11, 2026

fix(api): tell a missing key owner from an owner whose ban state is null

fix(credentials): report a refused connection host as host_not_allowed

fix(credentials): report an oversized Databricks token success as a 502

docs(api): say v2 execute options need a full-access key or api:write

chore(scripts): scope the payload-param allowlist to internal operations

fix(redaction): keep Infisical secret names visible; redact only deployKey

docs(networking): the SSRF guard matches NO_PROXY like curl, not like Bun

fix(api-keys): never echo an internal key-creation failure to the caller

chore: log a failed route-cache clear and spell out the read-only key rollback

fix(credentials): release saved secrets only to internal-JWT callers

fix(firecrawl): treat a blank maxDiscoveryDepth as unset

chore(credentials): log a broken JWKS and keep the successor map out of credential display

test: drop or tighten assertions that could not fail

fix(security): ignore a malformed CIDR NO_PROXY entry

chore(workflows): scope the paused-row read to its workflow and reuse the mutability guard

fix(credentials): never name a sibling credential in a trust-setup refusal

docs: correct the Helm readOnlyRootFilesystem note and the deployed-run variables TSDoc

test(credentials): rely on the shared env reset in the proxy validator tests

chore(helm): bump the chart version for the README correction

fix(redaction): keep prefixed secret keys masked while leaving Infisical's bare secretKey visible

fix(release): keep bare secretKey redacted, leave the proxy every-address rule to the transport, and report unknown GitLab hosts as input errors