diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 021f2f1c1..5eb124102 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -4664,3 +4664,15 @@ historical releases without a portable candidate bundle retain verification against their original `create-release.yml` publication provenance. Multi-asset download retries clear the activation marker, checksum manifest, and portable bundle first so a partial attempt cannot poison every later retry. + +### Stable v6.4.2 patch cutoff + +The stable v6.4.2 packet remains centered on the infrastructure-action and SSO +administrator-boundary fixes. Its final mainline cutoff also names every +customer-visible change that landed after the initial packet preparation: +bounded security setup request decoding, accurate PBS running and incomplete +backup state, Overview-level notification retry and dismissal, canonical +Assistant command-help dialog behavior, and agent server-address migration +guidance. Release-integrity detail also records authenticated Unified Agent +download validation and the exact-step candidate version binding. Packet proof +must retain those outcomes before v6.4.2 can be dispatched for publication. diff --git a/docs/releases/RELEASE_NOTES_v6.4.2.md b/docs/releases/RELEASE_NOTES_v6.4.2.md index 9d977c535..f70608956 100644 --- a/docs/releases/RELEASE_NOTES_v6.4.2.md +++ b/docs/releases/RELEASE_NOTES_v6.4.2.md @@ -9,6 +9,11 @@ actions and SSO-only deployments. - **Infrastructure actions honor role boundaries** - Browser and proxy users must now be administrators or hold an explicit action permission before they can plan, approve, view, or execute infrastructure actions. - **SSO access no longer implies administrator access** - An authenticated SSO user now needs an effective RBAC `admin` grant for administrator routes. Unassigned, `operator`, and `viewer` users remain non-administrative even when no local administrator exists. - **SAML allowlists fail closed** - A configured domain or email allowlist now rejects a SAML assertion that omits the email claim instead of bypassing the allowlist. +- **Security-sensitive setup requests are bounded** - Bootstrap, setup, repair, and recovery endpoints now reject oversized JSON request bodies before decoding them. +- **PBS backup state returns to idle reliably** - Failed backups, interrupted snapshots, and completed PBS-to-PBS sync copies no longer leave guests stuck in a Backup Running state. Incomplete artifacts remain visible as failed rather than appearing recoverable. +- **Delivery warnings can be resolved from Overview** - Retained notification failures can now be retried or dismissed directly from the Alerts overview while delivery history remains available. +- **Assistant command help behaves as a complete dialog** - Command help now traps focus, isolates the background, closes consistently, returns focus to its trigger, and uses the same responsive dialog behavior as the rest of Pulse. +- **Agent URL migration guidance is now included** - The built-in migration guide explains how to rerun the agent installer with the new server URL after moving or renaming a Pulse server. ## Before you upgrade diff --git a/docs/releases/V6_CHANGELOG_v6.4.2.md b/docs/releases/V6_CHANGELOG_v6.4.2.md index 54b7ec658..a8230fafa 100644 --- a/docs/releases/V6_CHANGELOG_v6.4.2.md +++ b/docs/releases/V6_CHANGELOG_v6.4.2.md @@ -19,6 +19,30 @@ _This changelog describes stable `v6.4.2` compared with stable `v6.4.1`._ action routes. - SAML domain and email allowlists now reject assertions without an email claim when either allowlist is configured. +- Security-sensitive bootstrap, setup, repair, and recovery request bodies now + have explicit size limits and reject oversized JSON before decoding. +- Pulse now distinguishes actively written PBS snapshots from terminally + incomplete artifacts by correlating incomplete snapshots with live PBS data + tasks. Failed backups and completed PBS-to-PBS sync copies no longer pin a + guest in Backup Running, and incomplete artifacts are excluded from + recoverable latest-backup pointers. +- The Alerts overview now exposes the same retry and dismiss actions as the + Notifications view for retained delivery failures, so operators can clear a + warning without deleting delivery history. +- Assistant command help now uses the canonical responsive dialog boundary, + including focus containment, background isolation, Escape and backdrop + dismissal, and focus return to the invoking control. +- The shipped migration guide now documents rerunning the agent installer with + a new URL when the Pulse server address changes. + +## Release integrity + +- Published release validation now authenticates every Unified Agent download + endpoint by checking its checksum and detached-signature headers against the + exact served bytes before activation. +- The release candidate verifier now binds the requested version explicitly in + the exact-SHA compiled-payload step, preventing step-local environment state + from aborting candidate assembly. ## Upgrade requirement diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 9790b3559..0e293185c 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -2066,6 +2066,12 @@ func TestV642SecurityPacketCoversBothAdministratorBoundaryFixes(t *testing.T) { for _, required := range []string{ "Infrastructure actions honor role boundaries", "SSO access no longer implies administrator access", + "SAML allowlists fail closed", + "Security-sensitive setup requests are bounded", + "PBS backup state returns to idle reliably", + "Delivery warnings can be resolved from Overview", + "Assistant command help behaves as a complete dialog", + "Agent URL migration guidance is now included", "map at least one trusted IdP group to the built-in `admin` role before upgrading", "The rollback target is stable `v6.4.1`", } { @@ -2076,6 +2082,13 @@ func TestV642SecurityPacketCoversBothAdministratorBoundaryFixes(t *testing.T) { for _, required := range []string{ "effective RBAC `admin` grant on `*`", "SSO-only installation must map at least one trusted IdP group", + "request bodies now\n have explicit size limits", + "completed PBS-to-PBS sync copies no longer pin a\n guest in Backup Running", + "Alerts overview now exposes the same retry and dismiss actions", + "Assistant command help now uses the canonical responsive dialog boundary", + "migration guide now documents rerunning the agent installer", + "authenticates every Unified Agent download", + "release candidate verifier now binds the requested version explicitly", "Promotion path: emergency stable patch from `main`", "Mobile decision: `no-mobile-impact`", } {