A single-fix release that closes a regression introduced by the interceptor-halt change in alpha-41. Authentication guards were returning the correct status codes but with empty response bodies.
Fixed: empty body on auth error responses
The auth guards in boundary.user (require-authenticated, require-admin, require-role, and the tenant/portal guards) build their 401/403 short-circuit responses through a shared create-error-response helper. That helper hardcoded a Content-Type: application/json header on the response.
muuntaja’s format-response middleware skips body encoding whenever a response already carries a Content-Type. Because the header was set by hand, the Clojure-map :body was handed to Jetty unencoded and written out as an empty body (Content-Length: 0).
This stayed invisible until alpha-41 (ZZP-117) made the interceptor enter phase actually halt on :response. Before that fix the guards fell through to the wrapped handler and never emitted this response, so the empty-body path was never exercised.
The fix drops the hardcoded Content-Type. muuntaja now negotiates the format and encodes the body exactly like a normal handler response, so an unauthenticated /api/v1 call returns the full JSON {:error :message :correlation-id} body instead of an empty one. Status codes are unchanged. A regression test asserts the short-circuit responses omit a hardcoded Content-Type.
Version alignment
All 28 libraries bumped to v1.0.1-alpha-42 to maintain lockstep versioning.
Upgrade
Re-run the installer to pick up the latest release:
curl -fsSL https://get.boundary-app.org | bashBackward compatible — no code or configuration changes required. If you deployed alpha-41 and rely on JSON bodies from auth failures, upgrading to alpha-42 is recommended.