sourcebot-dev · brendan-kellam · Jul 14, 2026 · Jul 14, 2026 · Jul 15, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- [EE] Verified signed online license assertions before granting paid feature entitlements. [#1442](https://github.com/sourcebot-dev/sourcebot/pull/1442)
+
 ## [5.1.0] - 2026-07-10
 
 ### Changed

diff --git a/packages/backend/package.json b/packages/backend/package.json
@@ -54,6 +54,6 @@
         "prom-client": "^15.1.3",
         "redlock": "5.0.0-beta.2",
         "simple-git": "^3.36.0",
-        "zod": "^3.25.74"
+        "zod": "^3.25.76"
     }
 }
diff --git a/packages/db/prisma/migrations/20260713000000_add_license_assertion/migration.sql b/packages/db/prisma/migrations/20260713000000_add_license_assertion/migration.sql
@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "License" ADD COLUMN "licenseAssertion" TEXT;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
@@ -373,6 +373,10 @@ model License {
   yearlyBillableOverageSeats    Int?
   yearlyPeakSeats               Int?
 
+  /// Compact, signed online-license assertion returned by Lighthouse.
+  /// Authorization must be derived from this assertion when it is present.
+  licenseAssertion  String?
+
   lastSyncAt        DateTime?
   lastSyncErrorCode String?
   createdAt         DateTime @default(now())

diff --git a/packages/shared/package.json b/packages/shared/package.json
@@ -23,7 +23,7 @@
         "strip-json-comments": "^5.0.1",
         "triple-beam": "^1.4.1",
         "winston": "^3.15.0",
-        "zod": "^3.25.74"
+        "zod": "^3.25.76"
     },
     "devDependencies": {
         "@types/micromatch": "^4.0.9",
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		-- AlterTable
		ALTER TABLE "License" ADD COLUMN "licenseAssertion" TEXT;