Skip to content

chore(deps): bump github.com/plexusone/systemforge from 0.11.0 to 0.24.0 - #29

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/plexusone/systemforge-0.24.0
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/plexusone/systemforge-0.24.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/plexusone/systemforge from 0.11.0 to 0.24.0.

Release notes

Sourced from github.com/plexusone/systemforge's releases.

v0.24.0

Release Notes: v0.24.0

Full Changelog: plexusone/systemforge@v0.23.0...v0.24.0

v0.23.0

Release Notes: v0.23.0

Full Changelog: plexusone/systemforge@v0.22.0...v0.23.0

v0.22.0

Release Notes: v0.22.0

Full Changelog: plexusone/systemforge@v0.21.0...v0.22.0

v0.21.0

Release Notes: v0.21.0

Full Changelog: plexusone/systemforge@v0.20.0...v0.21.0

v0.20.0

Release Notes: v0.20.0

Full Changelog: plexusone/systemforge@v0.19.0...v0.20.0

v0.19.0

Release Notes: v0.19.0

Full Changelog: plexusone/systemforge@v0.18.0...v0.19.0

v0.18.0

Release Notes: v0.18.0

Full Changelog: plexusone/systemforge@v0.17.0...v0.18.0

v0.17.0

Release Notes: v0.17.0

Full Changelog: plexusone/systemforge@v0.16.0...v0.17.0

v0.16.0

Release Notes: v0.16.0

Full Changelog: plexusone/systemforge@v0.15.0...v0.16.0

v0.15.0

Release Notes: v0.15.0

Full Changelog: plexusone/systemforge@v0.14.0...v0.15.0

... (truncated)

Changelog

Sourced from github.com/plexusone/systemforge's changelog.

[v0.24.0] - 2026-10-27

Highlights

  • identity/publicclient lets command-line tools and other public clients sign people in to SystemAuth and call SystemForge-powered APIs with DPoP-bound tokens, for tools a deployment ships to its users and tools others write against it alike. Nothing is registered per person or machine: a key is generated at login and the tokens are bound to it

Added

  • publicclient.Login: the authorization code flow with PKCE on a loopback redirect (RFC 8252, any port), a new P-256 DPoP key, ID token verification, and the key and tokens saved to a Store (c669c68)
  • Session.Transport and Session.HTTPClient: Authorization: DPoP with a proof bound to the access token (RFC 9449) on every request, refresh a minute before expiry, and one retry for use_dpop_nonce or invalid_token; the request body is closed on every path (c669c68)
  • publicclient.Open and Session.Logout: reuse a stored session, and revoke the refresh token and delete the credentials (c669c68)
  • publicclient.Store and FileStore: one owner-only file, refused when others can read it, written atomically and flushed with its directory so a crash cannot bring back a redeemed refresh token (31ffdf7)
  • publicclient.Locker, implemented by FileStore with flock or LockFileEx: processes sharing the credentials refresh and log out under the lock, and adopt tokens another process refreshed instead of redeeming the old refresh token, which SystemAuth would answer by revoking the login; the system releases the lock when its holder exits (6eaa391)

Dependencies

  • 1 dependency update

Documentation

  • Calling APIs with DPoP: command-line tools and other public clients, registration, storage and several processes (1e82ecb)
  • Calling APIs with DPoP: durable saves and the operating-system lock (9c2e039)
  • ADR-019 (proposed): the support UI, the requester's list of their own requests, and support tools built for agents first (e0d1bf7)
  • ADR-019: agents send a reply only after a person approves it (ddce341)
  • ADR-019: a support conversation keeps its reply address while it continues (cad9289)
  • v0.24.0 release notes

Tests

  • Against an embedded SystemAuth that requires DPoP nonces and an API behind relyingparty.BearerMiddleware: login, calls with proofs, Bearer refused, refresh with rotation, processes sharing credentials, logout, refused logins, the file store, unlock failures and closed request bodies (c84d638)

[v0.23.0] - 2026-10-27

Highlights

  • aauthrs accepts auth tokens only from their rightful issuer: in four-party only the Audience Access Server, in three-party only a trusted Person Server issuing for itself, so a Person Server trusted for person tokens can no longer grant itself scopes that bypass the Access Server
  • aauthrs refuses a request signed for another server, so an agent's signed request cannot be replayed to a resource it was not meant for
  • Updates aauth-go to v0.3.0

Breaking

  • aauthrs: an Access Server's auth tokens are accepted only when it is named in Config.Audience; listing it in TrustedIssuers no longer admits them, and a trusted issuer's auth token with dwk aauth-access.json is refused in three-party (051e23b)

Upgrade Guide

  • A resource that accepts auth tokens from an Access Server sets aauthrs.Config.Audience to it; when the Person Server and Access Server share one origin, name it in both TrustedIssuers and Audience
  • An application that also depends on aauth-go directly reviews its v0.3.0 migration guide: agent identifiers must be in their provider's domain, and servers built on its personserver and accessserver stores gain new methods

Security

... (truncated)

Commits
  • 23f0564 Merge pull request #68 from plexusone/docs/support-adr-v0.24.0
  • d8615de docs(release): add the ADR-019 support changes to v0.24.0
  • cb9eb95 docs(adr): merge the ADR-019 support UI and agent tools
  • 837acfa Merge pull request #67 from plexusone/docs/release-v0.24.0
  • 909c728 docs(release): add v0.24.0 changelog and release notes
  • 9c2e039 docs(publicclient): describe durable saves and the operating-system lock
  • 5335d56 Merge pull request #66 from plexusone/feat/dpop-public-client
  • 5db7eb5 test(publicclient): cover unlock failures, locked logout and closed bodies
  • 2e3296c fix(publicclient): close the request body when a request is not sent
  • f61d715 fix(publicclient): report unlock failures and hold the lock while logging out
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/plexusone/systemforge](https://github.com/plexusone/systemforge) from 0.11.0 to 0.24.0.
- [Release notes](https://github.com/plexusone/systemforge/releases)
- [Changelog](https://github.com/plexusone/systemforge/blob/main/CHANGELOG.md)
- [Commits](plexusone/systemforge@v0.11.0...v0.24.0)

---
updated-dependencies:
- dependency-name: github.com/plexusone/systemforge
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 30, 2026
@coderabbitai

coderabbitai Bot commented Oct 30, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: df43723a-008f-48d1-badd-9fec25d55e1d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #31.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/plexusone/systemforge-0.24.0 branch November 2, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants