Critical & security fixes:
- #18258 fix(drafts): validate draft context in TAXII and HTTP routes to prevent unauthorized access
- #19484 fix(ingestion): run JSONPath script expressions in a worker pool with a timeout
- #18949 fix(artifact): limit extracted size on artifact import
- #19541 chore(deps): update react-pdf to 11.0.0
- #19541 chore(deps): update graphql-tools to utils 12.1.0 and codegen to 7
- #19541 chore(deps): update follow-redirects, body-parser and zod
- #19475 fix(auth): harmonize redirect handling across authentication endpoints
- #18829 fix(stream): restrict origin attributes published in live streams
- #19216 chore(deps): security updates for LTS 7.260309.0
- #19314 fix(filters): improve wildcard filter operator queries
- #19308 fix(user): apply orga admin group checks when removing a user relation
- #19066 feat(xtm-hub): add a parameter to the XTM Hub browser messages
- #19157 fix(segregation): do not match inaccessible connected elements when searching relationships
- #19126 fix(users): list grantable groups when an organization admin creates user
- #18458 perf(safe-ejs): render templates on a pool of workers
- #19155 fix(docker): upgrade system packages in the platform and worker images
- #18618 fix(feed): refactor rolling feeds
- #18757 fix(refactor): refacto file handling
- #19029 chore(ci): fix all unbuntu runner to 26
- #18954 fix(stream): filter merge event sources according to user access
- #18937 chore(deps): updates for LTS 7.260309.0
- #17622 fix(front): css properties updated
Direct security updates:
- @graphql-tools/merge updated from 9.1.7 to 9.2.8
- @graphql-tools/schema updated from 10.0.31 to 10.1.5
- @graphql-tools/utils updated from 11.0.0 to 12.1.0
- axios updated from 1.19.0 to 1.20.0
- body-parser updated from 2.2.2 to 2.4.0
- bytes updated from — to 3.1.2
- zod updated from 4.3.6 to 4.6.7
- @graphql-codegen/cli updated from 6.1.2 to 7.4.6
- @graphql-codegen/introspection updated from 5.0.0 to 6.1.0
- @graphql-codegen/typescript-resolvers updated from 5.1.6 to 6.1.1
- @types/bytes updated from — to 3.1.6
- dompurify updated from 3.4.11 to 3.4.17
- react-pdf updated from 10.3.0 to 11.0.0
- pycti updated from 7.260309.0.8 to 7.260309.0.9
- cross-fetch updated from 4.1.0 to removed
- node-fetch updated from 2.7.0 to 3.3.2
- ws updated from — to 8.22.0
Indirect (transient) security updates:
- @ardatan/relay-compiler updated from 12.0.3 to 13.0.2
- @babel/code-frame updated from 7.29.0 to 7.29.7
- @babel/compat-data updated from 7.29.0 to 7.29.7
- @babel/core updated from 7.29.0 to 7.29.7
- @babel/generator updated from 7.29.1 to 7.29.12
- @babel/helper-compilation-targets updated from 7.28.6 to 7.29.7
- @babel/helper-globals updated from 7.28.0 to 7.29.7
- @babel/helper-module-imports updated from 7.28.6 to 7.29.7
- @babel/helper-module-transforms updated from 7.28.6 to 7.29.7
- @babel/helper-plugin-utils updated from 7.28.6 to 7.29.7
- @babel/helper-string-parser updated from — to 7.29.11
- @babel/helper-validator-option updated from 7.27.1 to 7.29.7
- @babel/helpers updated from 7.28.6 to 7.29.10
- @babel/parser updated from — to 7.29.12
- @babel/plugin-syntax-import-assertions updated from 7.28.6 to removed
- @babel/runtime updated from 7.28.6 to 8.0.7
- @babel/template updated from 7.28.6 to 7.29.7
- @babel/traverse updated from 7.29.0 to 7.29.12
- @babel/types updated from — to 7.29.11
- @envelop/core updated from 5.5.1 to 5.6.0
- @fastify/busboy updated from — to 3.2.4
- @graphql-codegen/add updated from 6.0.0 to 7.1.1
- @graphql-codegen/client-preset updated from 5.2.3 to 6.2.3
- @graphql-codegen/core updated from 5.0.0 to 6.2.2
- @graphql-codegen/gql-tag-operations updated from 5.1.3 to 6.1.1
- @graphql-codegen/plugin-helpers updated from 6.1.0 to 7.4.2
- @graphql-codegen/schema-ast updated from 5.0.0 to 6.1.1
- @graphql-codegen/typed-document-node updated from 6.1.6 to 7.2.0
- @graphql-codegen/typescript updated from 5.0.8 to 6.1.2
- @graphql-codegen/typescript-operations updated from 5.0.8 to 6.1.10
- @graphql-codegen/visitor-plugin-common updated from 6.2.3 to 7.4.0
- @graphql-hive/signal updated from 1.0.0 to 2.0.0
- @graphql-tools/apollo-engine-loader updated from 8.0.28 to 8.0.40
- @graphql-tools/batch-execute updated from 9.0.19, 10.0.5 to 10.2.0
- @graphql-tools/code-file-loader updated from 8.1.29 to 8.1.43
- @graphql-tools/delegate updated from 10.2.23, 12.0.8 to 12.2.1
- @graphql-tools/executor updated from 1.5.1 to 2.1.0
- @graphql-tools/executor-common updated from 0.0.4, 0.0.6, 1.0.6 to 1.1.0
- @graphql-tools/executor-graphql-ws updated from 2.0.7, 3.1.4 to 3.2.0
- @graphql-tools/executor-http updated from 1.3.3, 3.1.0, 3.3.0 to 3.4.1
- @graphql-tools/executor-legacy-ws updated from 1.1.25, 1.1.33 to 1.1.39
- @graphql-tools/git-loader updated from 8.0.33 to 8.0.46
- @graphql-tools/github-loader updated from 9.0.7 to 9.1.13
- @graphql-tools/graphql-file-loader updated from 8.1.19 to 8.1.24
- @graphql-tools/graphql-tag-pluck updated from 8.3.28 to 8.3.41
- @graphql-tools/import updated from 7.1.19 to 7.2.4
- @graphql-tools/json-file-loader updated from 8.0.33 to 8.0.38
- @graphql-tools/load updated from 8.1.16 to 8.1.21
- @graphql-tools/relay-operation-optimizer updated from 7.0.27 to 7.1.14
- @graphql-tools/url-loader updated from 8.0.33, 9.1.7 to 9.1.14
- @graphql-tools/wrap updated from 10.1.4, 11.1.8 to 11.2.1
- @inquirer/ansi updated from 1.0.2 to 2.0.9
- @inquirer/checkbox updated from 4.3.2 to 5.2.7
- @inquirer/confirm updated from 5.1.21 to 6.3.4
- @inquirer/core updated from 10.3.2 to 12.0.5
- @inquirer/editor updated from 4.2.23 to 5.3.5
- @inquirer/expand updated from 4.0.23 to 5.1.7
- @inquirer/external-editor updated from 1.0.3 to 3.0.6
- @inquirer/figures updated from 1.0.15 to 2.0.9
- @inquirer/input updated from 4.3.1 to 5.1.8
- @inquirer/number updated from 3.0.23 to 4.2.5
- @inquirer/password updated from 4.0.23 to 5.2.4
- @inquirer/prompts updated from 7.10.1 to 8.7.4
- @inquirer/rawlist updated from 4.1.11 to 5.3.7
- @inquirer/search updated from 3.2.2 to 4.3.5
- @inquirer/select updated from 4.4.2 to 5.2.7
- @inquirer/type updated from 3.0.10 to 4.2.0
- @types/ws updated from 8.18.1 to 8.18.2
- @whatwg-node/disposablestack updated from — to 0.1.0
- @whatwg-node/fetch updated from — to 0.12.1
- @whatwg-node/node-fetch updated from — to 0.9.2
- @whatwg-node/promise-helpers updated from — to 2.0.0
- asap updated from 2.0.6 to removed
- auto-bind updated from 4.0.0 to 5.0.1
- brace-expansion updated from 1.1.18 to 1.1.21
- brace-expansion updated from 2.1.4 to 2.1.7
- brace-expansion updated from 5.0.9 to 5.0.12
- bser updated from 2.1.1 to removed
- camel-case updated from 4.1.2 to removed
- capital-case updated from 1.0.4 to removed
- chalk updated from — to 5.6.2
- change-case updated from 4.1.2 to 5.4.4
- change-case-all updated from 1.0.15 to 2.1.0
- cli-truncate updated from 5.1.1 to 5.2.0
- cliui updated from 8.0.1 to 9.0.1
- colorette updated from 2.0.20 to removed
- constant-case updated from 3.0.4 to removed
- debounce updated from 2.2.0 to 3.0.0
- detect-indent updated from 6.1.0 to 7.0.2
- dot-case updated from 3.0.4 to removed
- dset updated from 3.1.4 to removed
- fast-string-truncated-width updated from — to 3.0.3
- fast-string-width updated from — to 3.0.2
- fast-wrap-ansi updated from — to 0.2.2
- fb-watchman updated from 2.0.2 to removed
- fbjs updated from 3.0.5 to removed
- fbjs-css-vars updated from 1.0.2 to removed
- follow-redirects updated from 1.16.0 to 1.16.1
- graphql-config updated from 5.1.5 to 5.1.8
- header-case updated from 2.0.4 to removed
- iconv-lite updated from 0.7.2 to 0.7.3
- immutable updated from 3.7.6 to 5.1.9
- is-lower-case updated from 2.0.2 to removed
- is-unicode-supported updated from 0.1.0 to 2.1.0
- is-upper-case updated from 2.0.2 to removed
- listr2 updated from 9.0.5 to 10.2.2
- lodash updated from 4.17.23 to 4.18.1
- log-symbols updated from 4.1.0 to 7.0.1
- lower-case updated from 2.0.2 to removed
- lower-case-first updated from 2.0.2 to removed
- minimatch updated from — to 10.2.6
- mute-stream updated from 2.0.0 to 3.0.0
- no-case updated from 3.0.4 to removed
- nullthrows updated from 1.1.1 to removed
- param-case updated from 3.0.4 to removed
- pascal-case updated from 3.1.2 to removed
- path-case updated from 3.0.4 to removed
- promise updated from 7.3.1 to removed
- qs updated from 6.15.2 to 6.16.1
- relay-runtime updated from 12.0.0 to removed
- sentence-case updated from 3.0.4 to removed
- setimmediate updated from 1.0.5 to removed
- signedsource updated from 1.0.0 to removed
- slice-ansi updated from — to 8.0.0
- snake-case updated from 3.0.4 to removed
- source-map-js updated from 1.2.1 to 1.2.2
- sponge-case updated from 1.0.1 to 2.0.3
- string-width updated from 8.2.0 to 8.3.0
- swap-case updated from 2.0.2 to 3.0.3
- sync-fetch updated from 0.6.0, 0.6.0-2 to 0.7.1
- tr46 updated from 0.0.3 to removed
- ts-log updated from 2.2.7 to 3.0.3
- tslib updated from 2.6.3 to 2.8.1
- ua-parser-js updated from 1.0.41 to removed
- undici updated from 6.29.0 to 6.29.1
- upper-case updated from 2.0.2 to removed
- upper-case-first updated from 2.0.2 to removed
- webidl-conversions updated from 3.0.1 to removed
- whatwg-mimetype updated from — to 5.0.0
- whatwg-url updated from 5.0.0 to removed
- wrap-ansi updated from 6.2.0 to 10.0.2
- yargs updated from 17.7.2 to 18.2.0
- yargs-parser updated from 21.1.1 to 22.0.0
- yoctocolors updated from — to 2.2.0
- yoctocolors-cjs updated from 2.1.3 to removed
- @napi-rs/canvas updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-android-arm64 updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-darwin-arm64 updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-darwin-x64 updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-linux-arm-gnueabihf updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-linux-arm64-gnu updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-linux-arm64-musl updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-linux-riscv64-gnu updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-linux-x64-gnu updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-linux-x64-musl updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-win32-arm64-msvc updated from 0.1.90 to 1.0.13
- @napi-rs/canvas-win32-x64-msvc updated from 0.1.90 to 1.0.13
- body-parser updated from 2.2.2 to 2.4.0
- content-type updated from — to 2.1.0
- es-toolkit updated from — to 1.52.0
- iconv-lite updated from — to 0.7.3
- pdfjs-dist updated from 5.4.296 to 6.3.289
- qs updated from — to 6.17.0
- side-channel updated from — to 1.1.1
- side-channel-list updated from — to 1.0.1
- type-is updated from — to 2.1.0
- undici updated from 7.30.0 to 7.30.1
Pull Requests:
- fix(front): css properties updated (#17622) by Céline Sèbe (@CelineSebe) in #18953
- chore(deps): updates for LTS 7.260309.0 (#18937) by Marie Flores (@marieflorescontact) in #18939
- fix(stream): filter merge event sources according to user access (#18954) by Marie Flores (@marieflorescontact) in #18969
- chore(ci): fix all unbuntu runner to 26 (#19029) by A. Jard (@aHenryJard) in #19039
- fix(refactor): refacto file handling (#18757) by Jeremy Cloarec (@JeremyCloarec) in #18942
- fix(feed): refactor rolling feeds (#18618) by Jeremy Cloarec (@JeremyCloarec) in #18944
- fix(docker): upgrade system packages in the platform and worker images (#19155) by Xavier Fournet (@xfournet) in #19169
- perf(safe-ejs): render templates on a pool of workers (#18458) by Xavier Fournet (@xfournet) in #19186
- fix(users): list grantable groups when an organization admin creates user (#19126) by Marie Flores (@marieflorescontact) in #19167
- fix(segregation): do not match inaccessible connected elements when searching relationships (#19157) by Jeremy Cloarec (@JeremyCloarec) in #19193
- feat(xtm-hub): add a parameter to the XTM Hub browser messages (#19066) by Sébastien Wauquier (@fellowseb) in #19187
- fix(user): apply orga admin group checks when removing a user relation (#19308) by Marie Flores (@marieflorescontact) in #19321
- fix(filters): improve wildcard filter operator queries (#19314) by Archidoit in #19351
- chore(deps): security updates for LTS 7.260309.0 (#19216) by app-pr-write-for-lts-updates[bot] in #19406
- fix(stream): restrict origin attributes published in live streams (#18829) by Marie Flores (@marieflorescontact) in #19441
- fix(auth): harmonize redirect handling across authentication endpoints (#19475) by Marie Flores (@marieflorescontact) in #19551
- chore(deps): update follow-redirects, body-parser and zod (#19541) by A. Jard (@aHenryJard) in #19542
- chore(deps): update graphql-tools to utils 12.1.0 and codegen to 7 (#19541) by A. Jard (@aHenryJard) in #19544
- chore(deps): update react-pdf to 11.0.0 (#19541) by A. Jard (@aHenryJard) in #19543
- fix(artifact): limit extracted size on artifact import (#18949) by Marie Flores (@marieflorescontact) in #19026
- fix(ingestion): run JSONPath script expressions in a worker pool with a timeout (#19484) by Terry PASQUET (@tpasquet) in #19553
- fix(drafts): validate draft context in TAXII and HTTP routes to prevent unauthorized access (#18258) by Florian DeLemarre (@delemaf) in #19529
Full Changelog: 7.260309.0-lts.8...7.260309.0-lts.9