1.31.0

⚠️ Important notes / Before you upgrade ⚠️

• Users without full READ and/or WRITE access (composite roles) lose access to all tunneling features
  We've added new read:tunnels and write:tunnels roles, therefore users with fine-grained access control lose access.
  You can manually assign the roles on the users page in the Manager UI, or through Keycloak itself.

What's Changed

🔒 Security updates

• CVE pending on Cross-realm MQTT session disconnect without authorization
• CVE pending on Gateway tunnel endpoints carry no @RolesAllowed: any authenticated user opens a bidirectional TCP circuit into an edge gateway's network
• CVE pending Registered edge gateway can write and delete arbitrary assets in any realm (reversible-ID authorization bypass)
• CVE pending Cross-realm gateway websocket events are not checked against the GatewayConnector realm
• CVE pending Cross-realm gateway tunnel-info disclosure (getGatewayActiveTunnelInfos missing realm scoping)

⭐ Enhancements

• Make purge available via PredictedFacade by @ebariaux in #3331

🐞 Bug fixes

• Predicted facade security enforcement by @ebariaux in #3330
• Historic facade security enforcement by @ebariaux in #3335

Other changes

• Bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 by @dependabot[bot] in #3334
• Fix: CI/CD extensions is triggered before version is updated by @denniskuijs in #3339
• Increase default test timeout for component tests by @Ekhorn in #3340
• Update CloudFormation templates to send query-exporter metrics to CloudWatch by @denniskuijs in #3315

Full Changelog: 1.30.1...1.31.0