Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Roadmap
v00.75.00 — Delivered

v00.75.00 — Delivered

✅ Delivered — on Maven Central. The Security Event Bus shipped in 00.75.00 and was hardened by two ticks (00.75.10 · 00.75.20); the current published release is 00.79.41. See the release notes and Quick Start.

Theme

A production-grade Security Event Bus as its own module set — sitting deliberately between today’s building blocks and the v00.80 high-security goals. It’s the event backbone later features (monitoring, SIEM integration, risk-based authentication, session revocation, device management, identity integrations) build on. It is not a generic messaging system and not a replacement for audit — audit becomes one consumer of the bus.

Delivered

  • Typed, signed security events — ~34 concrete JSentinelEvent records wrapped in a SignedJSentinelEventEnvelope; the Ed25519 signature binds tenant, type, expiry, producer, sequence, key id and payload hash.
  • Replay protection & ordering — mandatory replay defence and monotone per-(tenant, producer) sequencing with a configurable violation strategy.
  • Local listeners + REST/SSE bridge — GET /api/events/stream (replay-from-cursor + live tail, Last-Event-ID resume) and a permission-gated POST /api/events, so a Vaadin app can observe a REST service’s security events in near real time.
  • Producer policy + persistent stores — default-deny AllowListProducerPolicy; Eclipse-Store-backed, restart-safe replay / sequence / envelope / dead-letter stores.
  • Seven pluggable SPIs — signature, payload codec, key management, replay, sequence, producer policy, event/dead-letter store — each with an in-memory default and a @Test default contract suite in jSentinel-events-testkit.

Modules

jSentinel-events (SPI core, dependency-free), jSentinel-events-rest (REST/SSE bridge), jSentinel-events-testkit (contract suites), and jSentinel-events-persistence-eclipsestore (restart-safe stores).

Notes

  • Purely additive — four new modules, no existing source changed; every 00.71–00.74 module keeps its behaviour and mutation coverage by construction.
  • All new public types ship @ExperimentalJSentinelApi. The bus is feature-flagged (jsentinel.events.bus.enabled, default off).

Hardening ticks

The 00.75 line then took two production-review hardening ticks — additive, no new feature or module:

  • 00.75.10 — type-safe TokenHasher, a SpotBugs / FindSecBugs static-analysis gate over the four core modules, hardened manual JSON parsers, an instantiable JSentinelContext behind the static facade, and four urgent event-bus / Eclipse-Store fixes (R002–R005).
  • 00.75.20 — 39 production-review findings (R006–R044): secret-leak redaction, concurrency races, DoS guards, fail-closed @SecureRoute, OWASP-minimum KDF floors, adapter consistency and SLF4J migration.

Next

See the Roadmap — next up is v00.76.00 — jSentinel-jwt.

v00.74.00 — Deliveredv00.76.00 — Delivered