# Tachiban 2.1.0 released

**URL:** <https://discourse.hanakai.org/t/tachiban-2-1-0-released/1549>\
**Category:** sharing\
**Created:** [September 22, 2026, 4:17am UTC](https://discourse.hanakai.org/t/tachiban-2-1-0-released/1549 "2026-09-22T04:17:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebastjan\_hribar](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.hanakai.org/sebastjan_hribar/32/323_2.png) [@sebastjan\_hribar](https://discourse.hanakai.org/u/sebastjan_hribar)\
**Post date:** [September 22, 2026, 4:17am UTC](https://discourse.hanakai.org/t/tachiban-2-1-0-released/1549/1 "2026-09-22T04:17:09Z")

</div>

Hi,

[Tachiban](https://github.com/sebastjan-hribar/tachiban) 2.1.0 is available.

I’ve implemented a few security fixes, enhanced the password reset process and fixed the custom values overriding bug.

Details from the change log:

**Security fixes:**

- `authenticated?` no longer returns early when no user is found. It verifies the submitted password against a precomputed dummy hash instead, so existing and non-existing accounts take the same time to respond. This closes an account enumeration vulnerability where a valid email could be identified by a slower response.
- `authenticated?` also handles a user record with a nil `hashed_pass`, and returns false for a nil password instead of raising.
- `password_reset_url_valid?` now fails closed. It returns false for a nil user or a user with no `password_reset_sent_at`, where it previously raised NoMethodError.
- `session_expired?` now returns true when `session_start_time` is missing, rather than raising. An undateable session is treated as expired.
- Reset tokens are now 32 bytes (`SecureRandom.urlsafe_base64(32)`).

**New methods:**

- `verify_reset_token(token, link_validity_seconds: nil)` — performs the blank-token check, the user lookup and the expiry check in the correct order and returns the user or nil. Recommended over calling `password_reset_url_valid?` directly.
- `reset_token_attributes` — returns `{token: nil, password_reset_sent_at: nil}` for passing to the repo’s update method after a successful reset. **Tachiban does not invalidate tokens by itself.** Failing to clear them leaves reset links replayable indefinitely.

**New feature — custom method hooks:** Default values can now be overridden by defining private methods on your action instead of passing arguments. This makes defaults configurable for `before` callbacks like `handle_session`, which Hanami calls with a fixed argument list.