Jakub Zych 068adaabf9 fix(19.6.1-04): refuse code-declared role capture and wrap Administrators Runs ...

- Roles create and update refuse a submitted code that code-declared grants attach to
- compileActionExtensions wraps contributed Administrators Runs with guardOutranked
- Prove both holes on Postgres; keep the boot smoke callable with a superuser principal

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-22 13:29:38 +02:00

15 KiB

Raw Blame History

View Raw