4.0.0 release checklist #979

Tracks what has to land before tagging 4.0.0, and the release steps from docs/releasing.md. Everything listed here is in the Next Release Backlog column of project 11.

4.0.0 goals: dependencies maintained and free of known CVEs, no known security vulnerabilities in the platform (the levels stay vulnerable on purpose), no known bugs that exhaust the database or stop the platform working, and the new unified mobile app.

Before merging: PRs labelled Needs Manual Testing must be tested by hand from their branch first. Each one's description starts with the branch to check out, the steps, and what counts as broken. Record the result as a comment on the PR.

Blockers

Security (platform)

• GHSA-m4gj-wcx8-jjr7: unauthenticated /setup bypass (critical), PR fix: refuse /setup once installed and fail closed on the setup token (GHSA-m4gj-wcx8-jjr7) #959. Publish the advisory with the release.
• Setup throws NullPointerException when enableMongoChallenge or unsafeLevels is absent #956 Setup NPE when enableMongoChallenge / unsafeLevels are absent, PR fix: Setup NPE when optional parameters are missing (#956) #982
• [BUG] New Password Logged in Admin Password Reset Flow #571 New password logged in admin password reset, PR fix: stop logging plaintext new password in admin password reset #918
• [Security] Setup logs the real auth token when a setup request sends the wrong one #1053 Setup logs the auth token when it generates one, PR fix: stop logging the setup auth token when Setup generates it (part of #1053) #1056
• [BUG] CSRF tokens logged in Register servlet on token mismatch #971 CSRF tokens logged in Register, PR fix: stop logging CSRF tokens in Register and OpenAllModules (#971, #972) #980
• [BUG] CSRF token parameter logged in OpenAllModules servlet #972 CSRF token logged in OpenAllModules, PR fix: stop logging CSRF tokens in Register and OpenAllModules (#971, #972) #980
• [BUG] ChangeUserPassword throws NPE before its null check when player is missing #973 ChangeUserPassword NPE before its null check, PR fix: ChangeUserPassword NPE when the player parameter is missing (#973) #981
• Timezone bug: suspended user can authenticate on non-UTC JVM deployments #841 Suspended user can authenticate on non-UTC deployments (PR fix: use UTC calendar for JDBC timestamp reads #843), together with Default TZ to UTC instead of Europe/Dublin #970 (default TZ to UTC), PR build: default TZ to UTC instead of Europe/Dublin (#970) #1001
• authUserSSO result array: result[3] unset, result[5] double-assigned, wrong log message #820 authUserSSO result array bugs, PR fix: authUserSSO fills the tempPassword slot of its result array (#820) #985
• SSOLogin and SSOMetadata POST redirect to /saml/index.jsp, which doesn't exist #948 SSOLogin / SSOMetadata POST redirect to a missing page, PR fix: SSOLogin and SSOMetadata POST redirect to the application index (#948) #983
• SAML: reject ACS bindings other than HTTP-POST at startup #952 SAML: reject ACS bindings other than HTTP-POST, PR fix: refuse SAML ACS bindings other than HTTP-POST at startup (#952) #984

CVEs and supported versions

• jtidy r938 in FindXSS is affected by CVE-2023-34623 (stack overflow on nested input); no drop-in replacement #960 jtidy r938 (CVE-2023-34623) in FindXSS. The stack-overflow guard is in fix: stop deeply nested XSS submissions overflowing the stack in jtidy (part of #960) #1015; the rest goes with [Security] jtidy r938 in FindXSS loops forever on some short XSS submissions (one request pins a CPU core) #1002.
• [Security] jtidy r938 in FindXSS loops forever on some short XSS submissions (one request pins a CPU core) #1002 jtidy loops forever on some short XSS submissions (one request pins a CPU core)
• Upgrade vendored jQuery 1.7.1 / jQuery UI 1.8 + 1.11 and other front-end libraries #957 jQuery 1.7.1 / jQuery UI 1.8 + 1.11 and other front-end libraries, PRs build: upgrade jQuery to 3.7.1 and jQuery UI to 1.14.2 on platform pages (PR 1 of #957) #1010, build: upgrade lessons to jQuery 3.7.1 (PR 2 of #957) #1011, build: upgrade challenges to jQuery 3.7.1 and remove jQuery 1.7.1 (PR 3 of #957) #1012, build: replace TinySort 1.3.25 on the scoreboard (PR 4 of #957) #1013
• Upgrade MongoDB server 4.1.13 → 8.0 and Java driver 3.12 → 5.x #958 MongoDB server 4.1.13 → 8.0 and Java driver 3.12 → 5.x (includes Modernize MongoDatabase off legacy com.mongodb.DB API + Testcontainers; rescue disabled MongoDatabaseIT tests #876, it-test profile tags its Mongo build as mongo:${MONGODB_VERSION}, breaking the next local IT run #938), PRs build: move the MongoDB Java driver from 3.12 to mongodb-driver-sync 5.13 (PR 1 of #958) #1007, build: move MongoDB from 4.1.13 to 8.0.32 (PR 2 of #958) #1008, build: give the it-test MongoDB image its own name (PR 3 of #958) #1009
• Record the version and source of the vendored clipboard.js, or replace it #997 Record the version and source of the vendored clipboard.js, so it can be checked for known CVEs

Database exhaustion and broken functionality

• [BUG] SQL Injection Challenges 1,2,3,4 and 5 Stop Working After Several Queries #931 SQL Injection challenges exhaust their connection pools, PR fix: JDBC Resource Leaks in SQL Injection Challenges #932
• [EPIC] Convert challenge/lesson servlets to try-with-resources (connection-leak cleanup) #857 Remaining challenge/lesson servlets to try-with-resources (PR refactor: convert DirectObject* challenge servlets to try-with-resources (part of #857) #919 covers DirectObject), PRs fix: close JDBC resources in SQL injection challenges and lesson (part of #857) #998, fix: close JDBC resources in Session Management 2, 3 and 5 challenges (part of #857) #1004, fix: close JDBC resources in Session Management 6 and 7 challenges (part of #857) #1005, fix: close JDBC resources in CSRF, crypto, URL access and misconfiguration challenges (part of #857) #1016. Change only how resources are closed, never the vulnerability a level teaches.
• [LOG] regular fatal errors reported in log #735 False FATAL admin-access log entries, PR fix: stop logging false admin-access alerts when players open modules (#735) #954
• [BUG] XXE levels don't create solution file when opened #654 XXE levels don't create their solution file, PR fix: create the XXE levels' solution files on startup (#654) #1000
• Validate.validateLanguage rejects every two-letter language code, so module i18n always falls back to en_GB #937 validateLanguage rejects two-letter codes, so lessons are always English, PR fix: validateLanguage keeps the player's language instead of always en_GB (#937) #1014
• [BUG] NoSQL Injection 1 only answers once per Tomcat run: the servlet closes the shared MongoClient #992 NoSQL Injection 1 only answers once per Tomcat run, PR fix: NoSQL Injection 1 no longer closes the shared MongoClient (#992) #1019

Mobile

• feat(mobile): add unified Security Shepherd Android app #894 Unified Security Shepherd Android app, being split into PRs feat(mobile): add Mobile* servlets for the unified Android app #1062, feat(mobile): rename mobile modules and update cheatsheets for tested… #1065, feat(mobile): android app shell #1068, feat(mobile): add Client-Side Injection lesson and challenges to the Android app #1069
• Remove old mobile content + Replace with new unified app #829 Remove old mobile content and replace it with the unified app
• Add Mobile Lessons / Challenges to platform #830 Add mobile lessons / challenges to the platform
• Mobile - Update JSP pages for all mobile lessons and challenges #895 Update JSP pages for all mobile lessons and challenges (they still point players at the v3.1 VM's APKs)
• Mobile - Test mobile Lessons + Challenges #896, Test New Mobile Reverse Engineering Lessons/Challenges #922, Test New Mobile Poor Authentication Lessons/Challenges #923, Test New Mobile Insecure Authorization Levels #924, Test New Supply Chain Security Levels #925, Test New Mobile Insecure Communication Levels #926, Test New Mobile Insecure Crypto Levels #927, Test New Mobile Security Misconfiguration Levels #928, Test New Mobile Input Validation #929, Test New Mobile Privacy Controls Levels #930 Test the mobile lessons and challenges
• [BUG] Mobile apps cannot be built #752 Mobile apps cannot be built, PR feat(mobile): add unified Security Shepherd Android app #894
• Publish Mobile App #784 Publish the mobile app (APK attached to the GitHub release)

Release pipeline and tests

• Release to Dockerhub workflow has failed on every run since at least June 2026 #950 Release to Dockerhub workflow fails on every run, PR ci: fix the release workflow so it can publish images again (#950) #1017
• ci: least-privilege GITHUB_TOKEN and no long-lived tokens #865 Least-privilege GITHUB_TOKEN and no long-lived tokens in the release workflow, PR ci: push images to Docker Hub through its OIDC connection (part of #865) #1060
• [BUG] CloseAllModulesTestIT never runs: excluded by failsafe **/*Test* pattern #953 CloseAllModulesTestIT never runs, PR test: rename CloseAllModulesTestIT so failsafe runs it (#953) #993
• Docker build passes even though landing page does not load #554 Docker build passes even though the landing page doesn't load, PR test: smoke test the app in the Docker images (part of #1039) #1045
• Generated TLS certificate's locality is mojibake (L=BaileÃthaCliath): .env is read as ISO-8859-1 #961 Generated TLS certificate's locality is mojibake, PR fix: generate the TLS keystore when the container starts, not into the image (part of #991) #1036
• AGENTS.md: 'mvn -Pdocker validate' doesn't produce usable docker/mariadb init scripts #962 AGENTS.md: mvn -Pdocker validate doesn't produce usable init scripts, PR docs: mvn -Pdocker validate does not produce usable MariaDB init scripts (#962) #994
• Docs: make clear the Docker Compose setup is a quick start, not a production deployment #1020 README: the Docker Compose setup is a quick start, not a production deployment, PR docs: the Docker Compose setup is a quick start, not a production deployment (#1020) #1021

Moved out of 4.0.0

These don't block the release, and they no longer ship with it.

• 4.0.1: [BUG] Mongo setting in setup wizard doesn't affect mongo challenge availability #526, Add test coverage for SLS and ACS SAML auth servlets #879
• 4.1.0: Setup guide should start if core database can't be found #521, Wire up userLock brute-force protection (stored procedure exists but is unused) #824, Replace brittle Tomcat server.xml/web.xml patches with a robust mechanism #848 (with [BUG] Building Web Container Image fails: "Can't rename file ... server.xml ... Invalid argument #753), Set up the databases with scripts on stock MariaDB/MongoDB images instead of custom images #1046, Keep the NoSQL level closed when MongoDB is not configured #1102

#1084 (a single main branch) also waits for 4.1.0, so 4.0.0 and 4.0.1 follow the dev to master steps in docs/releasing.md.

Not in 4.0.0: production hardening of the Docker Compose quick start

The Docker Compose setup is a quick start, not a production deployment (#1020). Hardening it stays in the backlog, and the README says what to change for a real deployment: #814 (runtime database configuration), #988 (MongoDB without authentication), #987 (unused mongod.conf). The exception is #991, the image shipping the build's TLS key, which is fixed for 4.0.0 by #1036: each container now generates its own certificate on first start.

Release steps

• Check open Dependabot alerts and the WAR's runtime jars for known CVEs
• Upgrade notes in the release: Java 17, Tomcat 11 (recreate the conf volume), MariaDB 12.3, MongoDB 8.0, SAML on pac4j
• PR to dev: pom.xml 4.0.0-SNAPSHOT → 4.0.0
• Release PR dev → master, merged with a merge commit
• Tag 4.0.0 on the merge commit (admin), and check the Docker Hub images are published
• GitHub release with release notes and the mobile APK
• Publish GHSA-m4gj-wcx8-jjr7
• PR to dev: pom.xml → 4.1.0-SNAPSHOT

🤖 Generated with Claude Code