Sash 5571d5722f fix(remote-debug): gate registration messages on completed handshake (#800) ...

The remote-debugging TCP server authenticates clients with a handshake
message carrying a per-tenant key, but onMessage never enforced it:
ASSET_CHUNK, the declaration messages and END were all processed while
runtime.handshake was still false. The only enforcement was a 10 second
timer closing connections that never handshake, and a full registration
completes well inside that window, so an unauthenticated client could
write assets to media storage, consume connection slots and register
arbitrary plugin identities in the node registry.

Reject every registration message other than HAND_SHAKE until the
handshake completes, close the connection with a handshake failure and
latch handshakeFailed so later messages are ignored. The 10 second
timer stays as-is.

2026-08-24 17:12:30 +08:00

..

cluster

feat: support azure entraid for managed redis (#776)

2026-07-23 13:31:44 +08:00

core

fix(remote-debug): gate registration messages on completed handshake (#800)

2026-08-24 17:12:30 +08:00

db

feat: remove auto migrate when server start and add split migrate command (#672)

2026-04-03 10:59:27 +08:00

server

chore: plugin list improve (#790)

2026-08-07 10:13:04 +08:00

service

fix: make shared plugin runtime installs idempotent (#804)

2026-08-21 16:36:58 +08:00

storage/baidubos

feat: support bos as plugin storage (#735)

2026-05-15 13:30:28 +08:00

tasks

fix: make shared plugin runtime installs idempotent (#804)

2026-08-21 16:36:58 +08:00

types

fix: prevent concurrent plugin install conflicts (#794)

2026-08-06 16:48:56 +08:00