Skip to content

Release v2.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 07:55
· 87 commits to main since this release
v2.4.0
08fa584

Release v2.4.0: security fixes (see CHANGELOG/UPGRADING).

Changelog

Security

  • Menu item external URLs: the dashboard form now validates externalUrl with Assert\Url (http / https only). Rendered hrefs and JSON imports enforce a scheme allowlist (http, https, mailto, tel, or relative URLs): javascript:, data:, vbscript: … are rendered as # and dropped on import.
  • Dashboard access fails closed: DashboardAccessSubscriber is now always registered. With dashboard.enabled: false, dashboard routes answer 404 even if routes_dashboard.yaml is imported; security.access_roles: [] without a custom security.access_checker now denies access (it used to leave the dashboard open).

Full Changelog: v2.3.2...v2.4.0

Assets 2
Loading