Today's update (e0705b8) brings with it the following changes:
Security issues
- Fix cross-site-scripting vulnerability (XSS) in user profile about me
section.
- Fix cross-site-scripting vulnerability (XSS) in send_message(r).
- Fix all user enumeration vulnerability in search user UI. Now it only
searches your related users (e.g. from same institution).
- Upgrade CPAN package CryptX to 0.087 to fix multiple security vulnerabilities.
- Upgrade CPAN package Mozilla::CA to 20250602 to fix security vulnerability.
- Upgrade CPAN package Log::Any to 1.718 to fix security vulnerability.
Performance improvements
- Enable rate-limiting in web server to avoid denial-of-service attacks.
New features
- Add RED Prometheus metrics for observability.
- Add saturation Prometheus metrics for observability.
- Add audit events Prometheus metrics for observability.
- Protect information in the /metrics endpoint from the public for privacy.
Enhancements
- Upgrade to latest stable version of Perl, 5.42.0.
- Update all third-party CPAN packages to latest versions.
- Use official Nginx packages instead of Ubuntu versions.
- Use RenovateBot to keep third-party dependencies up to date.
Bugfixes
- Moved WYSIWYG content editor buttons around to support smaller screens better.