Highlights
Field Filter Always Strips Disallowed Fields
Previously, the allowed query config on a route and http.restrictedFields config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix.
Bug Fixes
- framework: Always strip fields that a field filter doesn't allow (#16704) — @shahednasser
- Remove correlated flag on search until it is supported (#16703) — @sradevski
- Disallow using JSON for schema index specification (#16692) — @sradevski
Contributors
Thank you to all contributors who made this release possible: