Stratum v1.0.0-rc.47

Release candidate. The final candidate before stable v1.0.0 — recommended for evaluation and staging.

Security

• Configuration sent to the agent is now validated strictly. An unrecognised field in a rule used to be ignored, which could silently widen a firewall rule from a single subnet to every address while reporting success. Unknown fields are rejected with a message naming the offending key, and the rule format is now identical across the API, the CLI and the documentation.
• Settings the packet engine cannot act on are refused when you create them rather than stored and ignored. A firewall rule with an unknown chain, a load balancer with an unknown protocol or an out-of-range port, an alert on a metric that is never sampled, and a bandwidth limit with an unknown direction were each accepted and then quietly did nothing.
• Updated dependencies to clear twelve published advisories, six of them in the PDF renderer used for invoices.

Fixes

• cenvero-str-ctl now exits with a failure status when a command fails. It previously printed the error and exited successfully, so scripts, CI pipelines and configuration-management runs treated failures as successes.
• Attaching a container to a managed network works. The generated interface name was one byte over the kernel's limit, so the operation always failed.
• Port-forward rules can now be listed and fetched through the API.
• Installing a plugin from a directory the agent cannot read now explains why and prints a working command, instead of reporting that the file does not exist.

Documentation

• Every command example in the documentation has been checked against the shipped binary and corrected. Some examples used options that were never implemented and would fail if copied.

Feedback on this release candidate is welcome — report issues through your account before the stable v1.0.0 cut.