OpenCRVS - v1.9.19

Introduction

OpenCRVS v1.9.19 is a hotfix release which includes a security fix and a deployment fix.
It is to be used in conjunction with a forked country configuration release v1.9.19

Security

• The user.actions endpoint in the events service now returns only audit metadata: action type, timestamp, acting user, event ID and tracking ID. It was authorised only by a user-management permission, yet returned the full record declaration of every action the target user had taken, so roles holding user.read:all, user.read:my-office or user.read:my-jurisdiction could read records they had no permission to open. The user audit history view is unchanged. GHSA-hmgw-v78r-jjc4 (High)

Bug fixes

• MinIO removed its images from quay.io and Docker Hub, so the MinIO server image could no longer be pulled. It now comes from an OpenCRVS-hosted copy of the same release, ghcr.io/opencrvs/minio:release.2025-06-13t11-33-47z. #13909

  Deployment notes:

  • Docker Swarm deployments also need opencrvs-countryconfig#1534, which moves the MinIO client (mc) to ghcr.io/opencrvs/minio-mc:release.2025-05-21t01-59-54z.