rConfig

vcore-8.2.8 scope: core Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 9d Configuration Management

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal

editorial:auto 9d

Starting with core-8.2.8, the `role` field on user creation and update APIs validates against a fixed set of allowed values, and granting or changing the Admin role now requires the acting account to already hold Admin privileges.

Why it matters: Affects all user‑creation and update operations; only accounts with the Admin role can assign Admin roles. Impacts any integration that programmatically creates or updates users or assigns roles.

Summary

AI summary

The role field now validates against allowed values and only admins can grant or change the Admin role.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	`role` field on user create/update validates against fixed set of allowed values. `role` field on user create/update validates against fixed set of allowed values. Source: llm_adapter@2026-07-17 Confidence: high	—
Breaking	High	Granting Admin role now requires the acting account to already hold Admin role. Granting Admin role now requires the acting account to already hold Admin role. Source: llm_adapter@2026-07-17 Confidence: high	—
Performance	Medium	Device reachability check job now looks up device by ID instead of carrying full record in payload. Device reachability check job now looks up device by ID instead of carrying full record in payload. Source: llm_adapter@2026-07-17 Confidence: high	—

Full changelog

Changed

The role field on user create and update now validates against a fixed set of allowed values instead of accepting any string.
Granting the Admin role to a user, including changing your own role, now requires the acting account to already hold the Admin role.
The device reachability check job now looks up the device by ID when it runs instead of carrying the full device record in the queued job payload.

Breaking Changes

`role` field on user creation and updates now validates against a fixed set of allowed values instead of accepting any string.
Granting or changing the Admin role now requires the acting account to already hold the Admin role.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track rConfig

Get notified when new releases ship.

About rConfig

Network device configuration management tool.

All releases →