openstack/keystonemiddleware — Week of 2026-10-31

Security fix. The week was dominated by a single auth_token hardening change landing on master plus four stable branches: a fix where the mere presence of a service token could bypass access_rules and token-bind enforcement on the user token. Each of the five lands adds ~190 lines of new logic and tests, so the behavior around how service tokens interact with user-token validation now gets exercised end-to-end rather than short-circuited. See the master change for the shape of the fix.

Config default flip. A companion change flips the default of service_token_roles_required so that service tokens must carry the required service role by default, closing a long-standing opt-in gap. This one landed on three branches alongside the bypass fix, meaning deployers upgrading on those branches get both the enforcement correction and the stricter default together.

Elsewhere. Two tiny bandit B105 (hardcoded-password-string) suppressions were applied to keep the lint gate green across backport branches.