Security audit: MEDIUM fixes — credential binding, transport, validation, deployAtEnd - #698

Open

gnodet wants to merge 8 commits into

security/audit-medium-fixes

Commits on Aug 31, 2026

fix: f001 (MEDIUM) — Keeps v1's structure: AbstractDeployMojo.validateCredentialBinding guard

gnodet
and
claude
committed
e7dcd6a
fix: f002 (MEDIUM) — Single choke point: AbstractDeployMojo.validateTransportSecurity(id,url)

gnodet
and
claude
committed
2d4d30e
fix: f003 (MEDIUM) — Both legs of the root cause closed with shared validators hoisted to Abs

gnodet
and
claude
committed
0e15f77
fix: f004 (MEDIUM) — Two-sided state fix, per the triage recommendation: (1) deployAllAtOnce

gnodet
and
claude
committed
21207aa
fix: f005 (MEDIUM) — A single class-level monitor (DEPLOY_AT_END_LOCK, a constant lock object

gnodet
and
claude
committed
4155d95
fix: f006 (MEDIUM) — Verified-true doc fix plus visibility escalation, per the finding brief.

gnodet
and
claude
committed
a5e9653
fix: adapt deployAtEnd re-deploy test for cache optimization compatibility

gnodet
and
claude
committed
6812306
fix: allow empty classifiers in deploy-file extras (IT regression)

gnodet
and
claude
committed
779362f