What litmuschaos/litmus shipped
Written by FoxPlug from the repository's own releases; not affiliated with Litmuschaos. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/litmuschaos/litmus; Litmuschaos did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of September 28, 2026
What shipped
- Infrastructure access keys now use cryptographically secure random generation instead of math/rand. Pull request #5633
- Fixed authorization scope for invitation and project leave operations to properly validate caller identity. Pull request #5600
- Go version bumped to 1.26.0 and crypto dependencies updated to address security vulnerabilities. Pull request #5627
- Five transitive npm dependencies in the web frontend patched to resolve critical security advisories. Pull request #5631
- Protobuf dependency conflicts in fuzzing tests resolved by updating replace pins and removing legacy entries. Pull request #5632
- Unit tests added for the Loader component covering loading, no-data, and default render states. Pull request #5567
- Unit tests added for ChaosHub fault output mapping validation. Pull request #5549
- Broken documentation links fixed in adopter and translation README files. Pull request #5619
Why it matters
This week addresses multiple security concerns including cryptographic key generation, authorization validation, and dependency vulnerabilities across the Go backend and web frontend. Test coverage improvements ensure component reliability moving forward.
Changelog entry
- Infrastructure access keys now generated using crypto/rand for secure random generation Pull request #5633
- Fixed authorization validation scope for AcceptInvitation, DeclineInvitation, and LeaveProject operations Pull request #5600
- Go version bumped to 1.26.0 and x/crypto updated to v0.56.0 Pull request #5627
- Five transitive npm dependencies patched for critical security advisories Pull request #5631
- Protobuf dependency replace pins updated from v0.21.2 to v0.33.1 for fuzzing test compatibility Pull request #5632
- Added unit test coverage for Loader component including loading, no-data, and default render states Pull request #5567
- Added unit tests for ChaosFaults component validating fault rendering and link parameters Pull request #5549
- Fixed broken documentation links in adopter and translation README files Pull request #5619
This week we strengthened security with proper cryptographic key generation, fixed authorization scope issues, updated dependencies, and improved test coverage across the platform.
Litmuschaos shipped critical security updates this week: infrastructure access keys now use cryptographically secure random generation, authorization scope issues are resolved, Go and npm dependencies patched for known vulnerabilities, and new unit tests added for Loader and ChaosHub components. These changes reinforce the platform's security posture and code reliability.
Week of September 14, 2026
What shipped
- Released version 3.32.0 with updates to installation manifests, OIDC provider naming, and StatusBadgeV2 component tests. Release
- Added GraphQL query complexity limiting via FixedComplexityLimit to prevent resource exhaustion from deeply nested or abusive queries. Pull request #5595
- Fixed OIDC callback to reject unverified email claims, preventing authentication with unverified email addresses. Pull request #5601
- Fixed silent data-loss where updating a ChaosEngine manifest via the UI would overwrite pre-existing node tolerations for runners and experiments. Pull request #5590
- Refactored PredefinedExperimentController to use getPredefinedExperiment API query instead of client-side filtering, reducing network payload. Pull request #5587
- Added YAML view to ChaosProbeConfiguration component allowing users to inspect complete probe configuration as read-only YAML. Pull request #5553
- Added fuzz tests for subscriber GraphQL data marshaling to validate JSON-marshalable payloads and safe GraphQL payload quoting. Pull request #5534
Why it matters
Version 3.32.0 addresses critical security and stability issues including email verification in authentication and data-loss prevention in experiment configuration. Query complexity limiting protects the GraphQL server from resource exhaustion attacks, while performance improvements reduce network overhead when loading predefined experiments.
Changelog entry
- Chore(3.31.0): Add the installation manifest for 3.31.0 version Release
- Generalize OIDC/Dex naming to be provider-agnostic Release
- Test: Add unit tests for StatusBadgeV2 component Release
- Test: Add fuzz tests for subscriber GraphQL data marshaling Pull request #5534
- Feat: Add YAML view to ChaosProbeConfiguration Pull request #5553
- Refactor(web): Use getPredefinedExperiment API in PredefinedExperiment controller Pull request #5587
- Fix(web): Prevent ChaosEngine tolerations data-loss during experiment UI updates Pull request #5590
- Feat: Add GraphQL query complexity limiting via FixedComplexityLimit Pull request #5595
- Fix(auth): Reject unverified email claims in the OIDC callback Pull request #5601
Litmus 3.32.0 is out. New GraphQL query complexity limiting prevents resource exhaustion. Fixed OIDC email verification and ChaosEngine toleration data-loss during UI updates. Improved performance for predefined experiments.
Litmus 3.32.0 released with important security and stability improvements. GraphQL query complexity limiting protects against resource exhaustion from nested queries. Fixed OIDC callback to properly validate email verification claims. Resolved data-loss regression in ChaosEngine tolerations during UI updates. Improved performance by optimizing predefined experiment loading with targeted GraphQL queries instead of full list pagination.