v8.2.2

We strongly recommend all administrators upgrade immediately.

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.1. Security hardening is also included.

• critical Ensure actor that signs the activity and the video are on the same host when receiving an Update activity GHSA-g9p4-f7h8-hc86
• high Check HLS filename when proxifying HLS files from object storage GHSA-93rr-g3x2-ffv4
• medium Ensure element belongs to the playlist on update/remove
• medium Do not leak video UUID on invalid video view
• medium Ensure user has rights to see private live specific metadata
• hardening Ensure ZIP entry filename is valid when extracting a ZIP export
• hardening Escape admin configuration when injecting it in HTML
• hardening Ensure version from plugin index is valid before injecting it in the CLI
• hardening Check caption VTT validity when adding a caption to a video
• hardening Invalidate all user tokens on password reset or password change

Bug fixes

• Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
• Allow restricted embed to be displayed on the origin instance
• Fix invalid state error on failed move job
• Fix missing mutex lock when managing video captions
• Fix broken embed when the tab is loaded in the background on Firefox
• Fix menu collapse/extend icon on RTL layout