ਇੱਥੇ openapi-oathkeeper ਦੇ 4 ਵਰਜ਼ਨ ਹਨ, 19 ਮਾਰਚ 2026 ਤੋਂ ਲੈ ਕੇ ਮੌਜੂਦਾ 0.8.0 ਤੱਕ। ਹਰ ਵਰਜ਼ਨ ਦਾ ਲਿੰਕ ਪ੍ਰਕਾਸ਼ਕ ਦੀਆਂ ਆਪਣੀਆਂ ਇੰਸਟਾਲਰ ਫ਼ਾਈਲਾਂ ਉੱਤੇ ਜਾਂਦਾ ਹੈ।
| ਵਰਜ਼ਨ | ਤਾਰੀਖ਼ | ਆਕਾਰ | ਫ਼ਾਈਲਾਂ |
|---|---|---|---|
| 0.8.0ਨਵਾਂ ਵਰਜ਼ਨ | 9 ਸਤੰਬਰ 2026 | — | 64-ਬਿੱਟ ZIP32-ਬਿੱਟ ZIP ਰਿਲੀਜ਼ ਨੋਟਸ## What's Changed
• Add integration tests by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/143
• feat:update dependencies and image version by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/144
• Capture array and object path params as explicit types by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/145
**Full Changelog**:https://github.com/cerberauth/openapi-oathkeeper/compare/v0.7.19...v0.8.0 |
| 0.7.19 | 7 ਸਤੰਬਰ 2026 | — | 64-ਬਿੱਟ ZIP32-ਬਿੱਟ ZIP ਰਿਲੀਜ਼ ਨੋਟਸ## Security fix
**High severity:** Overbroad path-parameter regex in generated Ory Oathkeeper access rules could cause an authentication/authorization bypass.
Previously, every OpenAPI `string` path parameter (and any parameter type the generator couldn't classify) was compiled to the unanchored regex token `<.+>`. Because `.` matches `/` in Go's regexp engine — and in Ory Oathkeeper's `regexp` matching strategy — a rule generated for a single path segment (e.g. `/public/{slug}`) also matched deeper, unrelated paths under the same prefix (e.g. `/public/admin/delete-all-users`). If those deeper paths weren't defined as their own, more specific OpenAPI operations, the broader (often unauthenticated `noop`) rule would match and proxy them instead of being rejected.
Generated rules for `string` and unclassified path parameters now use `<[^/]+>`, anchored to a single URL segment, matching the behavior already documented for numeric parameters.
**Action required:** Regenerate your Ory Oathkeeper access rules with this version and redeploy them. Rules generated by earlier versions using `string` path parameters may be broader than intended.
See [GHSA-9f3w-vm54-7gfc](https://github.com/cerberauth/openapi-oathkeeper/security/advisories/GHSA-9f3w-vm54-7gfc) for full details. Thanks to @EQSTLab for the responsible disclosure.
## What's Changed
• fix(generator):anchor string path-parameter regex to a single URL segment by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/142
**Full Changelog**:https://github.com/cerberauth/openapi-oathkeeper/compare/v0.7.18...v0.7.19 |
| 0.7.18 | 13 ਅਗਸਤ 2026 | — | 64-ਬਿੱਟ ZIP32-ਬਿੱਟ ZIP |
| 0.7.15 | 19 ਮਾਰਚ 2026 | — | 64-ਬਿੱਟ ZIP32-ਬਿੱਟ ZIP |