Starstruk Logo MarkStarstruk

26.8.2 v1.7.7

high risk

ruvnet/RuViewSep 30, 2026 → Sep 30, 20260 days between releases

What's New

Fixes critical Magic Link takeover and OAuth Proxy security issues.

Breaking Changes

  • Upgrade servers sharing Magic Link verification storage together and restart pending OAuth/SAML sign-ins.

New Features

  • Added `validateRedirectUri` for trusted deployments.
  • Added `verifyOAuthQueryParams` for signed authorization checks.

Improvements

  • Fixed concurrent PostgreSQL requests exceeding rate limits.
  • Fixed rate-limit and CAPTCHA errors missing JSON Content-Type headers.

Bug Fixes

  • Fixed critical Magic Link account-takeover vulnerability.
  • Fixed OAuth Proxy incorrectly accepting sign-in state.
  • Fixed ID-token sign-in ignoring social provider's `disableSignUp` setting.

Upgrade Notes

Upgrade servers sharing Magic Link verification storage together and restart pending OAuth/SAML sign-ins. Ensure all OAuth Proxy participants are upgraded simultaneously to prevent state mismatches.

The Two Releases

26.8.2

Release 26.8.2

Sep 30, 2026· 21 days ago

Minimal release notes: "26.8.2 Release Notes: https://docs.nvidia.com/nemo/retriever/latest/extraction/releasenotes/"

Full release notes
v1.7.7

v1.7.7

Sep 30, 2026· 21 days ago

A critical security release addressing Magic Link vulnerabilities and OAuth proxy issues.

Full release notes