Clients that also read the issuer's OpenID Connect discovery document
add openid, profile or email to their MCP authorize request, and the
MCP flavour refused those requests with invalid_scope ("scope contains
an unsupported value"), so they could not connect.
The three identity scopes are now dropped before the allow-list check,
as RFC 6749 section 3.3 lets a server grant fewer scopes than requested.
A request left with no other scope gets the read default. Any other
unknown scope, including a differently cased identity name, is still
refused. The MCP flavour still never grants identity scopes or issues
an id_token, and the metadata document is unchanged.
- attach.UploadWriterOptions (was the unexported uploadWriterOptions) gives
code that writes an upload to the bucket itself the same Content-Type and
Content-Disposition: attachment for non-inline types that attach.Store stores
- writeBlob calls it; Store behaviour unchanged
- TestUploadWriterOptions table test
- lagoon README, docs/database/attachments.md and docs/services/storage.md
describe it for writers that bypass attach.Store
- attach.StaticHandler and attach.StaticHandlerPublic set X-Content-Type-Options: nosniff on every response
- the stored disposition is read with one Attributes call after the is_public gate and sent on GET and HEAD; a value mime.ParseMediaType rejects is sent as attachment
- blobs without a stored disposition are served as before
- lagoon README, storage and attachments docs pages, surf uploads comment updated
Covers 33-14-SUMMARY.md, the release and deploy logs and the release notes. Release items settled: tags, changelog posts, grzybyfunkcjonalne.pl sitemaps and post head, G1 on the demo; W5 SQL check waived by Jakub. Open: live MCP session, Rich Results Test, visual and admin checks (with grzyby checklist items 3, 5, 6, 7). Seeds 33-UAT.md.
Importing attach/webp registers the encoder library's WebP decoder ahead
of the pure Go one for the whole process, so WebP uploads are decoded
through the system libwebp when it is installed. The lagoon README and
the attachments page say so and name -tags nodynamic.
- vue-seo-layer v0.2.0: the route report's noindex paths, sitemap pages per
locale and not over a catch-all, root files 503 while the backend is unknown
- vue-journal-layer v0.8.0: path-form listing routes, the catch-all upgrade
note, post article meta
- vue-menu-layer and vue-faq-layer v0.5.0: the catch-all upgrade note
- 33-14-vue-demo-app-locale.patch and 33-14-sm-demo-app-locale.patch move the
demo to prefix_except_default on top of the 33-12 demo patches
- release-note drafts for the framework, the three plugins and four layers
- the read-only RISK-MAX query for production databases
- deferred items and the broken-windows ledger after the six fixes
- layers: node --test runs checked with a TAP detector (self-tested), every
vue-seo-layer smoke, guard:check and purge:check, all five journal
expectation files (postTitleTag h1 and p), the journal purge checks and
check-git-install.sh --self-test
- consumers: the 33-12 and 33-13 app patches pass git apply --check, and
the 33-14 demo locale patches apply on top of the 33-12 ones in scratch
worktrees
- pact: the content kinds and tools, zero facts, the value types
- cabana: mergeRequestOptions precedence, one call per type, fail-open,
no shared maps
- attach: VariantKey on thumbnail names
- attach/webp: every image kind, the stored content type, the
broken-image thumbnail and a refused mode
- go: the framework's new unit tests by required name
- plugins: the sitemap, SEO and Journal unit tests by required name
- docker: the phase's Postgres suites by required name per plugin,
TestChromeRenderer when a Chrome or Chromium binary is present, and the
framework's lagoon/attach packages
