This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch docs
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/docs by this push:
new b54808d03e Make JSON-schema regex validation interruptible so a
tripped MCP DoS-guard reclaims its worker thread (TODO-359)
b54808d03e is described below
commit b54808d03edd52b98da561fb08c47fbeac207d6c
Author: James Bognar <[email protected]>
AuthorDate: Thu Aug 13 21:49:59 2026 -0400
Make JSON-schema regex validation interruptible so a tripped MCP DoS-guard
reclaims its worker thread (TODO-359)
JsonSchemaValidator.validateString now feeds pattern matching through an
InterruptibleCharSequence that samples Thread.isInterrupted() every 4096 charAt
reads and aborts the match. java.util.regex.Matcher does not observe
interrupts, so previously a catastrophically-backtracking pattern kept a
McpSchemaSafety VALIDATION_POOL worker pinning a core after the budget trip
already returned the client a fast -32602 (a mild DoS residual: N such requests
could pin N cores). With the wrapper, [...]
---
pages/release-notes/10.0.0.md | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/pages/release-notes/10.0.0.md b/pages/release-notes/10.0.0.md
index a51e835064..d3eb83cade 100644
--- a/pages/release-notes/10.0.0.md
+++ b/pages/release-notes/10.0.0.md
@@ -1051,6 +1051,10 @@ See
[juneau-rest-server-mcp](/docs/topics/JuneauRestServerMcp#replay-protection-
`2026-07-28`-only. The bounded, no-fetch `tools/call` input-schema validation
guard enforces a compute budget so a pathological schema (for example a
catastrophically-backtracking `pattern`) can't hang the request thread —
tripping `-32602` ("Tool input schema validation exceeded 100 ms") instead.
That budget is now charged against the **validating thread's actual CPU time**
rather than wall-clock time: OS scheduler preemption and thread-pool queueing
no longer count against it, only rea [...]
+### MCP `2026-07-28` — schema-safety validation is now interruptible (runaway
regex no longer pins a core)
+
+`2026-07-28`-only. When the compute budget above trips, the guard cancels the
validation task, but a catastrophically-backtracking `pattern` could previously
keep burning a core in the background even after the client had its fast
`-32602`, because `java.util.regex.Matcher` does not observe
`Thread.interrupt()`. Schema validation now feeds the matched string through an
interruptible `CharSequence`, so cancelling the task aborts a runaway match
promptly and the worker thread returns to id [...]
+
### MCP `2026-07-28` — OAuth 2.1 authorization: client acquisition + server
resource server (TODO-312f)
`2026-07-28`-only, and **off by default** — an endpoint that doesn't opt in
behaves exactly as before. 10.0.0 lands the OAuth 2.1 / MCP authorization
baseline in three slices: client-side token acquisition (F1), a server-side
resource-server (F2), and dynamic client registration + authorization hardening
(F3). Together they let a Juneau MCP client authenticate to, and a Juneau MCP
endpoint protect, a `2026-07-28` MCP resource end to end, covering the MCP
authorization SEPs at a baseline [...]
