chore(release): 1.21.4

CHANGELOG.md

@@ -2,8 +2,20 @@
 
 ## [Unreleased]
 
+## [1.21.4] - 2026-10-19
+
+### Release notes
+
+- Security dependency updates for open Dependabot alerts (#381), including the S3 storage backend's port from `aws-sdk-s3` 0.19 to 1.x. The S3 client sets request checksums and response validation to `WhenRequired` and pins the SDK behaviour version, which restores the checksum behaviour of the 0.19 SDK. `rustls-webpki` 0.101.7 (via `rocket_http` and `reqwest` 0.11) is still in the dependency graph and is not fixed by this release.
+- Pinned per-policy credential issuer set (TC-1452, #378): inert, no runtime effect until `share_email.credential_issuers` is configured.
+- Tests and docs only (#364): Policy/v3 root revocation tests and a doc, no runtime effect.
+- No database migrations.
+- Rollback is the 1.21.3 image (digest 601d91f1), with no database step.
+
 ### Changes
 
+- Dependency updates for open Dependabot alerts on the root `Cargo.lock`, including the S3 storage backend's port from `aws-sdk-s3` 0.19 to 1.x (checksums `WhenRequired`, SDK behaviour version pinned); the `test/m1-realdata-e2e` and `test/w5-policy-runtime-node-e2e` lockfiles are refreshed. `rustls-webpki` 0.101.7 via `rocket_http` and `reqwest` 0.11 remains.
+- Pinned per-policy credential issuer set (TC-1452, minor). `share_email.credential_issuers` takes a list of `{issuerDid, kid, alg: "EdDSA", publicKey, vcts, profiles, notBefore, retiredAt?, notAfter?}` entries; the legacy single issuer (`share_email.issuer_*`) joins as one more entry. policy/v3 credential admission looks the issuer up by the exact `(issuerDid, kid)` pair with no network fetch and only for DID methods on the allow-list, applies `notBefore`/`notAfter` to the clock and `notBefore`/`retiredAt` to the signed `iat` after the signature check, and admits only the entry's `vcts` and `profiles`. A policy names the issuer, so another issuer's credential cannot satisfy it; `issuerKid` in a policy's credential requirement is now optional. The node refuses to start on a set-load violation (non-EdDSA entry, duplicate `kid`, `kid` not `issuerDid#fragment`, `retiredAt` after `notAfter`, malformed or non-`Z` time, non-canonical Ed25519 key). Credentials verified through a configured entry must carry the JWT header `typ: "vc+sd-jwt"` and a header `kid`, which selects the entry and must equal the envelope and policy `kid`; the legacy single-issuer entry still accepts a header without `typ` or `kid`. The set also refuses, at start, a fixture or repeated-byte public key (outside the hermetic fixture build), one public key pinned twice, `notBefore` after `notAfter`, `retiredAt` before `notBefore`, and any issuer DID that is not `did:web`. The legacy entry has no validity window: its only compromise lever is removing it from the trust bundle. The issuer pin checks now also run when `issuer_public_key` is set and `share_email.enabled` is off.
 - Tests and docs (no behaviour change): a Policy/v3 root is revoked by its signer, the owner of a space its abilities touch (including a did:pkh wallet over SIWE), or the holder of a revoke control naming the space's delegations and the root's encryption network, over the generic `POST /revoke`; the JSON `RootRevocation/v1` route stays limited to the root's signer and, for the enforcement root, the enforcer. See `docs/policy-root-revocation.md` (TC-1423).
 
 ## [1.21.3] - 2026-10-19
@@ -18,7 +30,6 @@
 
 ### Changes
 
-- Pinned per-policy credential issuer set (TC-1452, minor). `share_email.credential_issuers` takes a list of `{issuerDid, kid, alg: "EdDSA", publicKey, vcts, profiles, notBefore, retiredAt?, notAfter?}` entries; the legacy single issuer (`share_email.issuer_*`) joins as one more entry. policy/v3 credential admission looks the issuer up by the exact `(issuerDid, kid)` pair with no network fetch and only for DID methods on the allow-list, applies `notBefore`/`notAfter` to the clock and `notBefore`/`retiredAt` to the signed `iat` after the signature check, and admits only the entry's `vcts` and `profiles`. A policy names the issuer, so another issuer's credential cannot satisfy it; `issuerKid` in a policy's credential requirement is now optional. The node refuses to start on a set-load violation (non-EdDSA entry, duplicate `kid`, `kid` not `issuerDid#fragment`, `retiredAt` after `notAfter`, malformed or non-`Z` time, non-canonical Ed25519 key). Credentials verified through a configured entry must carry the JWT header `typ: "vc+sd-jwt"` and a header `kid`, which selects the entry and must equal the envelope and policy `kid`; the legacy single-issuer entry still accepts a header without `typ` or `kid`. The set also refuses, at start, a fixture or repeated-byte public key (outside the hermetic fixture build), one public key pinned twice, `notBefore` after `notAfter`, `retiredAt` before `notBefore`, and any issuer DID that is not `did:web`. The legacy entry has no validity window: its only compromise lever is removing it from the trust bundle. The issuer pin checks now also run when `issuer_public_key` is set and `share_email.enabled` is off.
 - `/admin/stats` is a logged route label (TC-1482). The log shipper and the ingress log it as the route template plus status only, with no query string, `Authorization` header, request or response body, or client address (TC-961).
   - **N0 compose.** The embedded Vector configuration is regenerated for the new route. Together with the optional `NODE_STATS_READ_TOKEN` env line, the reviewed N0 compose template changes to `79469f97…` (raw `32a002ef…`; `docs/releasing.md`).
   - **`current_kv` C-index warning codes.** The log sidecar maps the three constant warnings of the TC-1274 `current_kv` C-index migration to `current_kv_c_index_missing`, `current_kv_c_index_invalid` and `current_kv_c_index_wrong_shape` (TC-1274); until then they would ship as `unclassified`. This is part of the same regenerated Vector configuration.

tinycloud-node-server/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.21.3"
+version = "1.21.4"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"