Mission Control 2.3.0 patches 13 known dependency vulnerabilities (8 high severity) and is a recommended upgrade for all self-hosted operators — especially any instance exposed beyond localhost.
Security
- next 16.2.10 → 16.2.11 — 9 advisories including SSRF in Server Actions (GHSA-89xv-2m56-2m9x, GHSA-p9j2-gv94-2wf4), middleware/proxy bypass (GHSA-6gpp-xcg3-4w24), response cache confusion, and DoS
- sharp 0.34.5 → 0.35.3 via bounded workspace override (GHSA-f88m-g3jw-g9cj, inherited libvips CVEs)
- brace-expansion DoS patched on all three resolved major lines (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg)
- Transitive postcss forced to ≥8.5.18 (GHSA-r28c-9q8g-f849)
No Mission Control application code required security changes; the full protected quality gate passed unchanged on the patch series.
Added
MC_DISABLE_RUNTIME_SCANenvironment flag to skip local CLI probing during runtime detection (#895)
Fixed
- Locale parity restored across all 10 locales with a permanent guard test in the quality gate (#907); missing
calMode_daytranslation (#894)
Changed
- Test toolchain on current majors: vite 8, vitest 4, @vitejs/plugin-react 6 (#908) — production builds remain webpack
Upgrade
- Back up the database and runtime configuration
- Upgrade from the protected
v2.3.0tag or corresponding immutable container digest - No migrations; no configuration changes required
Full notes: docs/releases/2.3.0.md · Changelog: CHANGELOG.md