Added
- [CLI] New
cvat-cli profilecommands to list, create, set the default, and delete saved Personal Access Token profiles. (#10875)
Changed
- In the backend server image, CVAT source files are now installed in
/opt/cvatrather than/home/django, and owned by root (#10575)
Removed
- Backend processes no longer write their logs to
logs/cvat_server.log(#10939)
Fixed
-
Fixed mask bounding box not shrinking after removing underlying pixels when another mask overlaps it with the "Remove underlying pixels" option enabled (#10873)
-
Fixed save annotations failure due to “spec_id is invalid” error (#10936)
-
Improved audio waveform timeline detail at larger zoom levels (#10947)
-
Fixed the caret jumping to the end while editing audio interval text attributes. (#10950)
-
Fixed standard undo/redo shortcuts in the editor of audio interval text attributes. (#10950)
-
Fixed misaligned resize handles for selected audio intervals. (#10951)
-
[Helm] Fixed backup/export workers using ephemeral storage for backup temporary files. (#10958)
Security
-
Fixed overly lax authorization rules for lambda function requests; viewing a request now requires access to its target task or job, while cancelling a request requires being the user who initiated it (https://github.com/cvat-ai/cvat/security/advisories/GHSA-m7p7-6w4m-886p)
-
Prevented users from blocking automatic annotation for inaccessible tasks (https://github.com/cvat-ai/cvat/security/advisories/GHSA-7xhx-3q27-xvcx)