v5.2.3

Changelog

Warning

This version includes important security improvements. Please update to this version as soon as possible.

🔐 Security patches

• Strengthened tenant boundaries to prevent cross-project access.
• Migrated public dashboard and chart share tokens to CB_ENCRYPTION_KEY.
• Rejected session tokens signed with the legacy CB_SECRET.
• Encrypted dashboard passwords and added rate limiting to password-protected dashboards.
• Encrypted SSH tunnel credentials and prevented secrets from being returned by the API.
• Restricted connection file operations to Chartbrew-managed storage.
• Tightened private-network policies for API connections.
• Hardened MongoDB variable processing.
• Added additional PostgreSQL and ClickHouse query guards.
• Protected the BullMQ admin dashboard with HTTP Basic Authentication.

🐛 Bug fixes

• Prevented snapshot schedules from being saved or executed without an email recipient or enabled integration.
• Fixed ClickHouse query formatting when processing variables.

⚙️ Configuration changes

• Added CB_BULLMQ_USERNAME and CB_BULLMQ_PASSWORD for protecting the BullMQ dashboard at /apps/queues.
• Added CB_ALLOW_LEGACY_SHARE_TOKENS as a temporary migration option for existing share links signed with CB_SECRET.
• Local .env installations automatically generate BullMQ credentials when they are not configured.

Contributors

• @tonghuaroot