Critical & security fixes:
- #17638 fix(email-template): update capabilities for mutations
- #16814 fix(stream): restrict context data depending on user access
- #17475 fix(ejs): remove comment before template validation
- #17471 fix(settings): Settings edit field patch
- #17476 fix(notifier): Playbook notifier component element access
- #17546 Improve label management for custom dashboard distribution widgets
- #17443 fix(simplelabeltooltip): simpleLabelTooltip
- #16987 chore: cleanup logs worker
Direct security updates:
- axios updated from 1.18.0 to 1.19.0
- uuid updated from 14.0.0 to 14.0.1
- http-proxy-middleware updated from 3.0.5 to 4.2.0
- monocart-reporter updated from 2.10.0 to 2.12.4
- lodash-es updated from — (transitive) to 4.18.1
- @aws-sdk/client-s3 updated from 3.993.0 to 3.1094.0
- @aws-sdk/client-sts updated from 3.993.0 to 3.1094.0
- @aws-sdk/credential-provider-node updated from 3.972.10 to 3.972.71
- @aws-sdk/lib-storage updated from 3.993.0 to 3.1094.0
- axios updated from 1.16.1 to 1.19.0
- axios-cookiejar-support updated from 6.0.5 to 7.0.0
- nodemailer updated from 9.0.1 to 9.0.5
- uuid updated from 14.0.0 to 14.0.1
- ws updated from 8.21.0 to 8.21.3
- langchain/core updated from 0.3.80 to 1.1.36
- langchain/mistralai updated from 0.2.0 to 1.0.7
- langchain/openai updated from 0.5.5 to 1.3.1
- @mistralai/mistralai updated from 1.7.2 to 1.15.1
- openai updated from 4.104.0 to 6.33.0
- zod updated from 3.25.76 to 4.3.6
- @opentelemetry/api updated from 1.9.0 to 1.9.1
- @opentelemetry/api-metrics updated from 0.33.0 to removed
- @opentelemetry/core updated from 1.25.1 to 2.10.0
- @opentelemetry/exporter-metrics-otlp-http updated from 0.52.1 to 0.221.0
- @opentelemetry/exporter-prometheus updated from 0.52.1 to 0.221.0
- @opentelemetry/exporter-trace-otlp-http updated from 0.52.1 to 0.221.0
- @opentelemetry/exporter-zipkin updated from 1.25.1 to 2.10.0
- @opentelemetry/otlp-transformer updated from 0.52.1 to 0.221.0
- @opentelemetry/resources updated from 1.25.1 to 2.10.0
- @opentelemetry/sdk-metrics updated from 1.25.1 to 2.10.0
- @opentelemetry/sdk-trace-base updated from 1.25.1 to 2.10.0
- @opentelemetry/sdk-trace-node updated from 1.25.1 to 2.10.0
- @opentelemetry/semantic-conventions updated from 1.25.1 to 1.43.0
Indirect (transient) security updates:
- lodash-es updated from 4.17.21 to 4.18.1
- seroval updated from 1.5.0 to 1.5.6
- seroval-plugins updated from 1.5.0 to 1.5.6
- fast-uri updated from 3.1.3 to 3.1.5
- ip-address updated from 10.2.0 to 10.5.0
- protobufjs updated from 7.6.1 to 7.6.5
- protobufjs updated from 7.5.4 to 7.6.5
- nodemailer updated from 9.0.1 to 9.0.5
- @apollo/protobufjs updated from 1.2.7 to 1.2.8
- brace-expansion updated from 1.1.15 to 1.1.18
- brace-expansion updated from 2.1.1 to 2.1.4
- brace-expansion updated from 5.0.5 to 5.0.9
Pull Requests:
- perf(docker): optimize worker Docker images (#16352) by @aHenryJard in #17064
- chore: cleanup logs worker related code (#16987) by @fellowseb in #17083
- chore(cd): implement rolling build and SBOM with GitHub workflow (#16821) by @aHenryJard in #17101
- fix(chart): improve simpleLabelTooltip (#17443) by @ludovic in #17543
- fix(dashboard): improve label management for custom dashboard distribution widgets (#17546) by @ludovic in #17561
- fix(notifier): Playbook notifier component element access (#17476) by @Archidoit in #17552
- fix: Improve elastic filters handling (#17508) by @mcartaud in #17580
- fix(settings): settings edit field patch (#17471) by @Archidoit in #17563
- refactor(safe-ejs): use JS AST parser to remove comments (#17475) (#17478) by @mcartaud in #17653
- fix(stream): restrict context data depending on user access (#16814) by @gabrielebonadiman in #17637
- fix(email-template): update capabilities for mutations (#17638) by @SarahBocognano in #17671
- fix(public-dashboard): Improve ensurePublicContext in public-dashboards (#17533) by @SarahBocognano in #17670
- fix(deps): LTS security maintenance 7.260309.0-lts.7 (#17681) by @aHenryJard in #17683
- fix(relations): allow participate-to relation creation admin org (#17375) by @ValentinBouzinFiligran in #17649
- fix(langchain): update langchain and zod - LTS maintenance 7.260309.0-lts.7 (#17681) by @aHenryJard in #17703
- fix(deps): LTS security maintenance 7.260309.0-lts.7 dedicated to opentelemetry (#17681) by @fellowseb in #17690
Full Changelog: 7.260309.0-lts.6...7.260309.0-lts.7