# mvirt 0.29.5

migrations: no
wire: unchanged
rev: 3aab83a99cf003e360906a17fcdc9e69898cf6e3

mvirt 0.29.5 — SECURITY

Fixes four cross-site-scripting sinks in the control plane's server-rendered
HTML (confirmed by tests on 0.29.4 and earlier). Roll out of cadence (§A2).

- cplane: every dynamic value in server-rendered HTML is escaped at the sink
  (rest/html.rs: `escape` for text/attributes, `js_string` for values inside
  <script> — escapes < > & and U+2028/2029 — and a single-pass placeholder
  fill):
  * CLI consent page rendered `client_info` from the unauthenticated
    /v1/auth/cli/pair unescaped to a signed-in user (both page states);
  * CLI sign-in page embedded login_hint/return_to in <script> via plain JSON,
    which does not escape "</script>" — reflected XSS on the password page;
  * the shared HTML error page (Accept: text/html) reflected title/detail —
    reachable with one unauthenticated GET, e.g. the OIDC callback's `error`.
- cplane: Content-Security-Policy-Report-Only (script-src 'self' + hash/nonce)
  on the control plane's HTML pages and a CSP report endpoint
  POST /v1/csp-reports (rate-limited, sanitized, deduplicated; findings are
  warn log events, component csp-report) (refs #193).
  NOTE: Report-Only is NOT a control. Until #413 switches it to enforcing, the
  protection on these pages is the escaping above, nothing else.
- logs: /v1/logs/stats applies the row feed's filters on both tiers
  (process/instance/trace) (refs #27); cold-feed paging no longer drops rows
  tied on a segment's end timestamp.
- everything in 0.29.4 (#140, #95, #407, #411, #35, #27, #62).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.