From a6d2003c57eb983d00d8950a77bb2993c1923d47 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Thu, 12 Nov 2026 20:38:39 +0100 Subject: [PATCH 1/6] build: set version 1.3.0 Set the version in pom.xml, in CITATION.cff (with the release date) and in the built-in service info. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011FSoqMpmDCfbACLj3uy6xV --- CITATION.cff | 4 ++-- pom.xml | 2 +- src/main/resources/service-info.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/CITATION.cff b/CITATION.cff index 7e1a4f88..0c8f7557 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -48,5 +48,5 @@ keywords: - REST API - Spring Boot license: Apache-2.0 -version: "1.2.0" -date-released: "2026-11-09" +version: "1.3.0" +date-released: "2026-11-12" diff --git a/pom.xml b/pom.xml index 52be127d..314729f2 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ uk.ac.ebi.tsc tesk - 1.2.0 + 1.3.0 jar tesk diff --git a/src/main/resources/service-info.yaml b/src/main/resources/service-info.yaml index 5cf199d8..cbd66d4f 100644 --- a/src/main/resources/service-info.yaml +++ b/src/main/resources/service-info.yaml @@ -12,7 +12,7 @@ contactUrl: https://github.com/elixir-cloud-aai/tesk-api/issues documentationUrl: https://tesk.readthedocs.io/en/latest/tesk-api/ createdAt: 2021-04-06 environment: dev -version: 1.2.0 +version: 1.3.0 storage: - ftp://ftp-private.ebi.ac.uk # TESK supports no backend parameters (TES 1.1) From 7b7b44581cf8a84b26d5c85166031f547b82fe9f Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Thu, 12 Nov 2026 20:40:02 +0100 Subject: [PATCH 2/6] docs: add the 1.3.0 release and upgrade notes Curated release notes in docs/releases/1.3.0.md; the upgrade notes "To 1.3.0" (from "To the next release", with the TES 1.1 changes that clients may notice); "Since 1.3.0" for the service client settings; the cosign example with 1.3.0. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011FSoqMpmDCfbACLj3uy6xV --- docs/configuration.md | 2 +- docs/deployment.md | 2 +- docs/releases/1.3.0.md | 19 +++++++++++++++++++ docs/upgrading.md | 36 +++++++++++++++++++++++++++++++++--- 4 files changed, 54 insertions(+), 5 deletions(-) create mode 100644 docs/releases/1.3.0.md diff --git a/docs/configuration.md b/docs/configuration.md index ad43ee23..0a04638d 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -32,7 +32,7 @@ Environment variable | Meaning `TESK_API_AUTHORISATION_*` | Authorisation by group membership: `TESK_API_AUTHORISATION_GROUPS_CLAIM` (default `eduperson_entitlement`), `…_GROUP_PREFIX`, `…_GROUP_SUFFIX`, `…_DELIMITER`, `…_PARENT_GROUP`, `…_ENV_SUBGROUP`, `…_BASE_GROUP` and `…_ADMIN_SUBGROUP`; see [Access control](access-control.md#configuration) for their meanings and defaults. `TESK_API_AUTHORISATION_LEGACY_USER_LABELS` | `true`: tasks created by earlier versions, which have only the old creator label, belong to their creators again; `false` (default): only team admins and super admins see them. See [Access control](access-control.md#task-creators). In the Helm chart of TESK: `auth.legacyUserLabels` (from chart 0.3.0). `TESK_API_AUTHORISATION_CLAIM_*` | Authorisation without groups, by a claim of the user info; off by default. Turning it on lets everyone with one of the configured values run tasks; see [Access control](access-control.md#authorisation-without-groups) for the settings and their security implications. -`TESK_API_AUTHORISATION_SERVICE_CLIENTS_*` | Access tokens of allow-listed service clients (OAuth 2.0 client credentials grant, e.g. of a gateway), checked locally against the issuer's keys instead of at the user info endpoint; off by default. Every holder of a listed client's credentials can run tasks; see [Access control](access-control.md#tokens-of-services) for the settings and their trust implications. +`TESK_API_AUTHORISATION_SERVICE_CLIENTS_*` | Access tokens of allow-listed service clients (OAuth 2.0 client credentials grant, e.g. of a gateway), checked locally against the issuer's keys instead of at the user info endpoint; off by default. Every holder of a listed client's credentials can run tasks; see [Access control](access-control.md#tokens-of-services) for the settings and their trust implications. Since 1.3.0. `TESK_API_SWAGGER_UI_ENABLED` | `true`: serves the [Swagger UI](api.md#swagger-ui) at `/swagger-ui/index.html` (the root path `/` redirects there) with its static resources and its configuration (`/swagger-resources`). `false` (default): serves none of them. The API description (`/v2/api-docs`) is served either way. Other values stop the app at startup. Turning it on serves the Swagger UI and its static resources publicly, also with the `auth` profile: turn it on only where it is needed. Since 1.2.0; before, the Swagger UI was always on. `TESK_API_SWAGGER_OAUTH_*` | The OpenID Connect client of the Swagger UI, with the `auth` profile: `TESK_API_SWAGGER_OAUTH_CLIENT_ID`, `…_IMPLICIT` (default `true`: the implicit grant; `false`: the authorisation code grant without a client secret), `…_AUTHORIZATION_ENDPOINT`, `…_TOKEN_ENDPOINT` and `…_SCOPES`; see [Access control](access-control.md#built-in-client) for their meanings and defaults, and what the authorisation code grant needs. `TESK_API_SWAGGER_OAUTH_CLIENT_SECRET` | Deprecated since 1.2.0 and ignored: the Swagger UI is a public client and gets no client secret. TESK API logs a warning at startup if it is set. Remove it from your deployment; if a client secret was configured while the Swagger UI was on (always the case before 1.2.0, with the `auth` profile), rotate that secret at your identity provider (see [Upgrading](upgrading.md#to-120)). diff --git a/docs/deployment.md b/docs/deployment.md index b9b760c3..412a2335 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -14,7 +14,7 @@ version tag, with [cosign](https://docs.sigstore.dev/cosign/system_config/installation/): ```bash -cosign verify elixircloud/tesk-api:1.2.0 \ +cosign verify elixircloud/tesk-api:1.3.0 \ --certificate-identity-regexp '^https://github\.com/elixir-cloud-aai/tesk-api/\.github/workflows/release\.yml@refs/tags/v' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com ``` diff --git a/docs/releases/1.3.0.md b/docs/releases/1.3.0.md new file mode 100644 index 00000000..ebaafd1f --- /dev/null +++ b/docs/releases/1.3.0.md @@ -0,0 +1,19 @@ +TESK API 1.3.0 brings the task fields, list filters and task states of TES 1.1, optional access for tokens of allow-listed service clients (e.g., a TES gateway that calls TESK with its client-credentials token), and experimental support for private executor images. Deployments need no changes, as the new options are off by default, but clients may notice changed answers, e.g., `CANCELING` before `CANCELED` and `400 Bad Request` for wildcard outputs without `path_prefix`: read the [upgrade notes](https://tesk.readthedocs.io/en/latest/tesk-api/upgrading/#to-130) before you upgrade. Uploading the matches of wildcard outputs needs a taskmaster whose filer supports `path_prefix` ([tesk-core#134](https://github.com/elixir-cloud-aai/tesk-core/pull/134)). + +## Features + +- Optional access for tokens of allow-listed service clients (OAuth 2.0 client credentials grant), checked locally against the issuer's keys, as principals of their own that create, list, get and cancel their own tasks; settings `TESK_API_AUTHORISATION_SERVICE_CLIENTS_*` (#153, #154) +- The task fields of TES 1.1 are accepted: `outputs[].path_prefix` is passed to the taskmaster, `inputs[].streamable` is ignored, `executors[].ignore_error` only as `false`, and `backend_parameters_strict: true` is refused; service info reports TES `1.1.0` (#133) +- `GET /tasks` filters by `state`, `tag_key` and `tag_value` (#143, #149) +- Tasks report `CANCELING` while the pods of a cancelled task still run, and `PREEMPTED` when Kubernetes disrupted all failed executors (#144, #151) +- `backend_parameters` are no longer stored or returned; ignored keys are logged and listed in `system_logs`, and service info lists `tesResources_backend_parameters` (`[]`) (#145, #147) +- Outputs with wildcards but no `path_prefix` are refused with `400 Bad Request`, unless they go to `file:` URLs, as TES 1.1 requires (#148, #152) +- Experimental: private executor images, with registry credentials in the executor fields `docker_registry`, `docker_login` and `docker_pass`, passed to Kubernetes as image-pull Secrets owned by the taskmaster's job and never returned (#55, #141) + +## Fixes + +- Inputs and outputs with `"type": null` are accepted as `FILE`, as when `type` is left out, as TES 1.1 allows (#146, #150) + +## Maintenance + +- CI runs of pull requests are cancelled only by newer commits (#142) diff --git a/docs/upgrading.md b/docs/upgrading.md index ccf08f9f..819bf2a7 100644 --- a/docs/upgrading.md +++ b/docs/upgrading.md @@ -1,8 +1,10 @@ # Upgrading -## To the next release +## To 1.3.0 -From 1.2.0, clients may notice changed answers: +From 1.2.0, deployments need no changes: the new options are off by +default. TESK API 1.3.0 accepts the task fields and list filters of TES 1.1, +and clients may notice changed answers: - **Wildcards without `path_prefix`.** An output whose `path` has wildcards (`*`, `?`, `[`) but no `path_prefix` is refused with `400 Bad Request`, @@ -10,7 +12,35 @@ From 1.2.0, clients may notice changed answers: `path_prefix` for such outputs (see [TES 1.1 fields](api.md#tes-11-fields)). Before, such a task ran, and its output then failed or uploaded nothing useful. Clients that send such outputs to other URLs set `path_prefix`, - e.g. to the part of `path` before its first wildcard. + e.g. to the part of `path` before its first wildcard. Uploading the + matches of a pattern needs a taskmaster whose filer supports `path_prefix` + ([tesk-core#134](https://github.com/elixir-cloud-aai/tesk-core/pull/134)). +- **`CANCELING` and `PREEMPTED`.** A cancelled task is `CANCELING` while a + pod of its taskmaster, executors or outputs filer is still running, and + `CANCELED` only once they have ended; a task whose failed executors were + all disrupted by Kubernetes (preemption, eviction, node pressure, taints) is + `PREEMPTED` instead of `EXECUTOR_ERROR` (see [Getting + tasks](index.md#getting-tasks)). Clients that wait for `CANCELED` after a + cancel request wait until the pods have ended; clients that know only the + states of TES 1.0 must accept the new ones. +- **`backend_parameters`.** They are no longer stored or returned, also for + tasks created by earlier versions; with the view `FULL`, a task lists the + keys it ignored in `logs[0].system_logs`. Tasks that also set + `backend_parameters_strict: true` are refused with `400 Bad Request`, as + TESK supports no backend parameters. + Service info lists `tesResources_backend_parameters` (always `[]`); keep + it at `[]` in your own service info file, if you use one. +- **Service info.** `type.version` is `1.1.0` instead of `1.0.0`. If you + use your own file (`TESK_API_SERVICE_INFO_LOCATION`), update `type.version` + and `version` there, too. + +New, off until you use them: tokens of allow-listed service clients +(`TESK_API_AUTHORISATION_SERVICE_CLIENTS_*`, see [Tokens of +services](access-control.md#tokens-of-services); in the Helm chart of TESK +after 0.3.0: `auth.tokenClients`) and private executor images, an experimental +workaround that needs `create` and `delete` on `secrets` (see [Private +executor images](api.md#private-executor-images) and +[Deployment](deployment.md)). ## To 1.2.0 From 860707d041a21cfa61a3b1ad6c0a015dcb41ac44 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Thu, 12 Nov 2026 20:42:59 +0100 Subject: [PATCH 3/6] docs: list the release prep in the 1.3.0 notes Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011FSoqMpmDCfbACLj3uy6xV --- docs/releases/1.3.0.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/releases/1.3.0.md b/docs/releases/1.3.0.md index ebaafd1f..8b0d2f2f 100644 --- a/docs/releases/1.3.0.md +++ b/docs/releases/1.3.0.md @@ -17,3 +17,4 @@ TESK API 1.3.0 brings the task fields, list filters and task states of TES 1.1, ## Maintenance - CI runs of pull requests are cancelled only by newer commits (#142) +- Release preparation (#155) From b6823c15619db0eeec4f1a42673500a94d6c2ef7 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Thu, 12 Nov 2026 20:58:12 +0100 Subject: [PATCH 4/6] docs: clarify the 1.3.0 notes from review Name the TES 1.1 fields that are refused (ignore_error: true, strict backend parameters), say that only tasks created by 1.3.0 list ignored keys, that wildcard outputs to URLs without a scheme need no path_prefix, and that docker_registry is returned. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011FSoqMpmDCfbACLj3uy6xV --- docs/releases/1.3.0.md | 4 ++-- docs/upgrading.md | 13 ++++++++++--- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/docs/releases/1.3.0.md b/docs/releases/1.3.0.md index 8b0d2f2f..3f332b11 100644 --- a/docs/releases/1.3.0.md +++ b/docs/releases/1.3.0.md @@ -7,8 +7,8 @@ TESK API 1.3.0 brings the task fields, list filters and task states of TES 1.1, - `GET /tasks` filters by `state`, `tag_key` and `tag_value` (#143, #149) - Tasks report `CANCELING` while the pods of a cancelled task still run, and `PREEMPTED` when Kubernetes disrupted all failed executors (#144, #151) - `backend_parameters` are no longer stored or returned; ignored keys are logged and listed in `system_logs`, and service info lists `tesResources_backend_parameters` (`[]`) (#145, #147) -- Outputs with wildcards but no `path_prefix` are refused with `400 Bad Request`, unless they go to `file:` URLs, as TES 1.1 requires (#148, #152) -- Experimental: private executor images, with registry credentials in the executor fields `docker_registry`, `docker_login` and `docker_pass`, passed to Kubernetes as image-pull Secrets owned by the taskmaster's job and never returned (#55, #141) +- Outputs with wildcards but no `path_prefix` are refused with `400 Bad Request`, unless they go to `file:` URLs or URLs without a scheme (taken as `file:`), as TES 1.1 requires (#148, #152) +- Experimental: private executor images, with registry credentials in the executor fields `docker_registry`, `docker_login` and `docker_pass`, passed to Kubernetes as image-pull Secrets owned by the taskmaster's job; `docker_login` and `docker_pass` go only into the Secret and are never returned, while `docker_registry` is stored and returned (#55, #141) ## Fixes diff --git a/docs/upgrading.md b/docs/upgrading.md index 819bf2a7..31bfed1d 100644 --- a/docs/upgrading.md +++ b/docs/upgrading.md @@ -6,6 +6,13 @@ From 1.2.0, deployments need no changes: the new options are off by default. TESK API 1.3.0 accepts the task fields and list filters of TES 1.1, and clients may notice changed answers: +- **TES 1.1 fields.** `outputs[].path_prefix`, `inputs[].streamable`, + `executors[].ignore_error` and `resources.backend_parameters_strict` are + accepted instead of being refused as unknown fields, with two exceptions + that are refused with `400 Bad Request`, as TESK can't do what they ask: + `ignore_error: true` (TESK stops at the first executor that fails) and + `backend_parameters_strict: true` with `backend_parameters` (see [TES 1.1 + fields](api.md#tes-11-fields)). - **Wildcards without `path_prefix`.** An output whose `path` has wildcards (`*`, `?`, `[`) but no `path_prefix` is refused with `400 Bad Request`, unless its `url` is a `file:` URL or has no scheme, as TES 1.1 requires @@ -25,9 +32,9 @@ and clients may notice changed answers: states of TES 1.0 must accept the new ones. - **`backend_parameters`.** They are no longer stored or returned, also for tasks created by earlier versions; with the view `FULL`, a task lists the - keys it ignored in `logs[0].system_logs`. Tasks that also set - `backend_parameters_strict: true` are refused with `400 Bad Request`, as - TESK supports no backend parameters. + keys it ignored in `logs[0].system_logs` (only tasks created by 1.3.0 or + later: earlier versions recorded no ignored keys, so their tasks list + none). Service info lists `tesResources_backend_parameters` (always `[]`); keep it at `[]` in your own service info file, if you use one. - **Service info.** `type.version` is `1.1.0` instead of `1.0.0`. If you From 432aba120fae7d3df198ccbfc59790d0525b5686 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Thu, 12 Nov 2026 21:06:36 +0100 Subject: [PATCH 5/6] docs: add the release issue to the 1.3.0 notes Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011FSoqMpmDCfbACLj3uy6xV --- docs/releases/1.3.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/releases/1.3.0.md b/docs/releases/1.3.0.md index 3f332b11..3e45911a 100644 --- a/docs/releases/1.3.0.md +++ b/docs/releases/1.3.0.md @@ -17,4 +17,4 @@ TESK API 1.3.0 brings the task fields, list filters and task states of TES 1.1, ## Maintenance - CI runs of pull requests are cancelled only by newer commits (#142) -- Release preparation (#155) +- Release preparation (#156, #155) From e2f6d797caa2130b29ee65df9a13d19aee1d5e44 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Sat, 14 Nov 2026 23:55:22 +0100 Subject: [PATCH 6/6] docs: update the 1.3.0 notes for the latest merges Lists the changes merged into dev since the notes were written: Java 21 (#161), ignore_error (#174), the resource server (#175), output file logs (#176), the Kubernetes client (#178), Dependabot labels (#181), the executor job selector (#183) and full test coverage (#184). Adds a Breaking changes section, as in the 1.2.0 notes, and sets date-released to the planned tag date, 2026-11-16. Co-Authored-By: Claude Opus 5.5 --- CITATION.cff | 2 +- docs/releases/1.3.0.md | 32 ++++++++++++++++++++++++++------ 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/CITATION.cff b/CITATION.cff index 0c8f7557..4375fc48 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -49,4 +49,4 @@ keywords: - Spring Boot license: Apache-2.0 version: "1.3.0" -date-released: "2026-11-12" +date-released: "2026-11-16" diff --git a/docs/releases/1.3.0.md b/docs/releases/1.3.0.md index 375a418d..69feef14 100644 --- a/docs/releases/1.3.0.md +++ b/docs/releases/1.3.0.md @@ -1,25 +1,45 @@ -TESK API 1.3.0 brings the task fields, list filters and task states of TES 1.1, optional access for tokens of allow-listed service clients (e.g., a TES gateway that calls TESK with its client-credentials token), and experimental support for private executor images. Deployments need no changes, as the new options are off by default, but clients may notice changed answers, e.g., `CANCELING` before `CANCELED`, `400 Bad Request` for wildcard outputs without `path_prefix`, and pages of at most 256 tasks from `GET /tasks` without `page_size`: read the [upgrade notes](https://tesk.readthedocs.io/en/latest/tesk-api/upgrading/#to-130) before you upgrade. Uploading the matches of wildcard outputs needs a taskmaster whose filer supports `path_prefix` ([tesk-core#134](https://github.com/elixir-cloud-aai/tesk-core/pull/134)). +TESK API 1.3.0 brings TES 1.1 to TESK: its task fields, including `ignore_error`, its list filters and task states, and output file logs. It also brings optional access for tokens of allow-listed service clients (e.g., a TES gateway that calls TESK with its client-credentials token) and experimental support for private executor images, and it runs on Java 21 and validates tokens with the resource server of Spring Security instead of the end-of-life Spring Security OAuth. The new options are off by default, but deployments may have to check their JVM options and the order in which they upgrade TESK API and the taskmaster, and clients may notice changed answers, e.g., `CANCELING` before `CANCELED`, `400 Bad Request` for wildcard outputs without `path_prefix`, pages of at most 256 tasks from `GET /tasks` without `page_size`, and `401 Unauthorized` for tokens sent in the URL: read the [upgrade notes](https://tesk.readthedocs.io/en/latest/tesk-api/upgrading/#to-130) before you upgrade. `ignore_error` and output file logs need a taskmaster and filer of [tesk-core](https://github.com/elixir-cloud-aai/tesk-core/releases) 0.12.0 or later, deployed after this release, not before it; uploading the matches of wildcard outputs needs a taskmaster whose filer supports `path_prefix` ([tesk-core#134](https://github.com/elixir-cloud-aai/tesk-core/pull/134)). + +## Breaking changes + +- The image runs TESK API on Java 21 instead of Java 8; JVM options in `JAVA_OPTS` that Java 21 removed stop the JVM at startup (#162, #161) +- A single task's executors are selected by the labels `taskmaster-name` and `job-type=executor`, so that TESK API works with taskmasters that also label the filers' jobs (tesk-core 0.12.0 and later); upgrade TESK API first and such a taskmaster after the rollout, or both at once with the `Recreate` strategy (#182, #183) +- Access tokens are read only from the `Authorization: Bearer` header; an `access_token` parameter in the URL or a form is ignored (#165, #175) +- Outputs with wildcards but no `path_prefix` are refused with `400 Bad Request`, unless they go to `file:` URLs or URLs without a scheme (taken as `file:`), as TES 1.1 requires (#148, #152) +- `GET /tasks` without `page_size` returns pages of at most 256 tasks, the default of TES, instead of all tasks at once (#137, #158) +- Tasks report `CANCELING` while the pods of a cancelled task still run, and `PREEMPTED` when Kubernetes disrupted all failed executors (#144, #151) ## Features - Optional access for tokens of allow-listed service clients (OAuth 2.0 client credentials grant), checked locally against the issuer's keys, as principals of their own that create, list, get and cancel their own tasks; settings `TESK_API_AUTHORISATION_SERVICE_CLIENTS_*` (#153, #154) -- The task fields of TES 1.1 are accepted: `outputs[].path_prefix` is passed to the taskmaster, `inputs[].streamable` is ignored, `executors[].ignore_error` only as `false`, and `backend_parameters_strict: true` is refused; service info reports TES `1.1.0` (#133) +- The task fields of TES 1.1 are accepted: `outputs[].path_prefix` is passed to the taskmaster, `inputs[].streamable` is ignored, and `backend_parameters_strict: true` is refused; service info reports TES `1.1.0` (#133) +- `executors[].ignore_error: true` lets a task go on after the executor fails, with a taskmaster that supports it (tesk-core 0.12.0 and later) (#159, #174) +- `logs[0].outputs` lists the files that the outputs filer uploaded, with a taskmaster and filer that record them (tesk-core 0.12.0 and later) (#160, #176) - `GET /tasks` filters by `state`, `tag_key` and `tag_value` (#143, #149) -- `GET /tasks` without `page_size` returns pages of at most 256 tasks, the default of TES, instead of all tasks at once (#137, #158) -- Tasks report `CANCELING` while the pods of a cancelled task still run, and `PREEMPTED` when Kubernetes disrupted all failed executors (#144, #151) - `backend_parameters` are no longer stored or returned; ignored keys are logged and listed in `system_logs`, and service info lists `tesResources_backend_parameters` (`[]`) (#145, #147) -- Outputs with wildcards but no `path_prefix` are refused with `400 Bad Request`, unless they go to `file:` URLs or URLs without a scheme (taken as `file:`), as TES 1.1 requires (#148, #152) - Experimental: private executor images, with registry credentials in the executor fields `docker_registry`, `docker_login` and `docker_pass`, passed to Kubernetes as image-pull Secrets owned by the taskmaster's job; `docker_login` and `docker_pass` go only into the Secret and are never returned, while `docker_registry` is stored and returned (#55, #141) +## Security + +- Tokens are validated with the resource server of Spring Security instead of the end-of-life Spring Security OAuth; the `401` for an invalid token no longer repeats the token, malformed bearer headers are refused without a call to the user info endpoint, and calls to that endpoint time out (#165, #175) +- SnakeYAML 2 instead of 1.33 (CVE-2022-1471), with version 28 of the Kubernetes Java client (#164, #178) + ## Fixes - Inputs and outputs with `"type": null` are accepted as `FILE`, as when `type` is left out, as TES 1.1 allows (#146, #150) +- Inputs are validated without a JavaScript engine, which Java 21 lacks; the message for an input without a source now names the check (`inputs[0].urlOrContentGiven`) (#162, #161) +- Run outside a cluster with a token in its kubeconfig file, TESK API can cancel tasks: patches keep the token's `Bearer` prefix (#164, #178) +- A user info answer without `sub` gives `401` instead of `500` (#165, #175) +- A groups claim of `null` gives no group authorities instead of one named `null`, and a task that can't be serialized fails its creation with `500` instead of creating a job that can't run (#179, #184) ## Documentation -- The API docs list the differences from TES 1.1; supporting `ignore_error: true` and reporting output file logs are tracked in #159 and #160 (#137, #158) +- The API docs list the differences from TES 1.1 (#137, #158) ## Maintenance +- Version 28 of the Kubernetes Java client instead of 11 (#164, #178) +- Tests cover all lines and branches, enforced by JaCoCo and Codecov (#179, #184) - CI runs of pull requests are cancelled only by newer commits (#142) +- Dependabot labels its pull requests with `type: dependencies` only (#180, #181) - Release preparation (#156, #155)