1.23.1

This is a security-focused patch release. Please read the upgrade notes before you upgrade.

⚠️ Upgrade notes

• PostgreSQL 14 or higher is now required. Label Studio now runs on Django 5.2, which doesn't support PostgreSQL 13 or older.

• New secure defaults:

  • SSRF_PROTECTION_ENABLED=true: outbound requests to private or local network addresses are blocked. This affects URL imports, webhooks, S3-compatible endpoints, and Redis storage.
  • ML_BLOCK_LOCAL_IP=true: ML backends on localhost or a private network are blocked.
  • DEBUG_MODAL_EXCEPTIONS=false: error details are no longer shown in the UI.

  If your ML backend, MinIO, Redis, or webhook receiver runs on a local or private network, set SSRF_PROTECTION_ENABLED=false and/or ML_BLOCK_LOCAL_IP=false. Alternatively, keep the protection on and change the blocked ranges with USE_DEFAULT_BANNED_SUBNETS and USER_ADDITIONAL_BANNED_SUBNETS.

Security

• Stronger SSRF protection for ML backends, webhooks, cloud storage, and URL imports.
• Tighter permission checks when you create storages, webhooks, and ML backends, and when you delete users.
• Fixed access checks for local file storage and Data Manager filters.
• Improved HTML sanitization in the labeling interface.