Critical & security fixes:
- #18258 fix(drafts): validate draft context in TAXII and HTTP routes to prevent unauthorized access
- #19484 fix(ingestion): run JSONPath script expressions in a worker pool with a timeout
- #18949 fix(artifact): limit extracted size on artifact import
- #19525 chore(deps): update react-pdf to 11.0.0
- #19525 chore(deps): update follow-redirects, body-parser and zod
- #19525 chore(deps): update graphql-tools to utils 12.1.0
- #19475 fix(auth): harmonize redirect handling across authentication endpoints
- #18829 fix(stream): restrict origin attributes published in live streams
- #19414 chore(frontend): improve vite environment loading
- #19217 chore(deps): security updates for LTS 7.260811.0
- #19314 fix(filters): improve wildcard filter operator queries
- #19333 fix(chatbot): improve request handling of the chatbot file upload
- #19308 fix(user): apply orga admin group checks when removing a user relation
- #19066 feat(xtm-hub): add a parameter to the XTM Hub browser messages
- #19157 fix(segregation): do not match inaccessible connected elements when searching relationships
- #19126 fix(users): list grantable groups when an organization admin creates user
- #18458 perf(safe-ejs): render templates on a pool of workers
- #19155 fix(docker): upgrade system packages in the platform and worker images
- #18618 fix(feed): refactor rolling feeds
- #18757 fix(refactor): refacto file handling
- #19029 chore(ci): fix all unbuntu runner to 26
- #18954 fix(stream): filter merge event sources according to user access
- #18938 chore(deps): updates for LTS 7.260811.0
- #17622 fix(front): css properties updated
- #18652 fix(organization): improvement of organization segregation
- #18637 fix(ingestion): confine feed execution identity to its creator rights
Direct security updates:
- @graphql-tools/merge updated from 9.2.2 to 9.2.8
- @graphql-tools/schema updated from 10.0.38 to 10.1.5
- @graphql-tools/utils updated from 11.2.2 to 12.1.0
- axios updated from 1.19.0 to 1.20.0
- body-parser updated from 2.3.0 to 2.4.0
- bytes updated from — to 3.1.2
- zod updated from 4.4.3 to 4.6.7
- @graphql-codegen/cli updated from 7.2.0 to 7.4.6
- @graphql-codegen/typescript-resolvers updated from 6.1.0 to 6.1.1
- @types/bytes updated from — to 3.1.6
- dompurify updated from 3.4.13 to 3.4.17
- react-pdf updated from 10.4.1 to 11.0.0
- pycti updated from 7.260811.0.1 to 7.260811.0.2
- content-type updated from — to 2.1.0
- ws updated from — to 8.22.0
Indirect (transient) security updates:
- @babel/plugin-syntax-import-assertions updated from 7.29.7 to removed
- @fastify/busboy updated from — to 3.2.4
- @graphql-codegen/add updated from 7.1.0 to 7.1.1
- @graphql-codegen/client-preset updated from 6.1.0 to 6.2.3
- @graphql-codegen/core updated from 6.2.0 to 6.2.2
- @graphql-codegen/gql-tag-operations updated from 6.1.0 to 6.1.1
- @graphql-codegen/plugin-helpers updated from 7.1.0 to 7.4.2
- @graphql-codegen/schema-ast updated from 6.1.0 to 6.1.1
- @graphql-codegen/typed-document-node updated from 7.1.0 to 7.2.0
- @graphql-codegen/typescript updated from 6.1.0 to 6.1.2
- @graphql-codegen/typescript-operations updated from 6.1.2 to 6.1.10
- @graphql-codegen/visitor-plugin-common updated from 7.2.2 to 7.4.0
- @graphql-tools/apollo-engine-loader updated from 8.0.34 to 8.0.40
- @graphql-tools/batch-execute updated from 10.0.9 to 10.2.0
- @graphql-tools/code-file-loader updated from 8.1.36 to 8.1.43
- @graphql-tools/delegate updated from 12.1.0 to 12.2.1
- @graphql-tools/documents updated from 1.0.1 to 1.0.2
- @graphql-tools/executor updated from 1.5.7 to 2.1.0
- @graphql-tools/executor-common updated from 1.0.6 to 1.1.0
- @graphql-tools/executor-graphql-ws updated from 3.1.5 to 3.2.0
- @graphql-tools/executor-http updated from 3.3.0 to 3.4.1
- @graphql-tools/executor-legacy-ws updated from 1.1.32 to 1.1.39
- @graphql-tools/git-loader updated from 8.0.40 to 8.0.46
- @graphql-tools/github-loader updated from 9.1.6 to 9.1.13
- @graphql-tools/graphql-file-loader updated from 8.1.18 to 8.1.24
- @graphql-tools/graphql-tag-pluck updated from 8.3.35 to 8.3.41
- @graphql-tools/import updated from 7.1.18 to 7.2.4
- @graphql-tools/json-file-loader updated from 8.0.32 to 8.0.38
- @graphql-tools/load updated from 8.1.15 to 8.1.21
- @graphql-tools/optimize updated from 2.0.0 to 2.0.1
- @graphql-tools/relay-operation-optimizer updated from 7.1.8 to 7.1.14
- @graphql-tools/url-loader updated from 9.1.6 to 9.1.14
- @graphql-tools/wrap updated from 11.1.20 to 11.2.1
- @types/ws updated from 8.18.1 to 8.18.2
- @whatwg-node/disposablestack updated from — to 0.1.0
- @whatwg-node/fetch updated from — to 0.12.1
- @whatwg-node/node-fetch updated from — to 0.9.2
- @whatwg-node/promise-helpers updated from — to 2.0.0
- follow-redirects updated from 1.16.0 to 1.16.1
- graphql-config updated from 5.1.6 to 5.1.8
- qs updated from — to 6.16.1
- source-map-js updated from 1.2.1 to 1.2.2
- sync-fetch updated from 0.6.0 to 0.7.1
- undici updated from 6.28.1 to 6.29.1
- undici updated from 8.10.2 to 8.12.3
- whatwg-mimetype updated from — to 5.0.0
- @napi-rs/canvas updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-android-arm64 updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-darwin-arm64 updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-darwin-x64 updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-linux-arm-gnueabihf updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-linux-arm64-gnu updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-linux-arm64-musl updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-linux-riscv64-gnu updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-linux-x64-gnu updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-linux-x64-musl updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-win32-arm64-msvc updated from 0.1.100 to 1.0.13
- @napi-rs/canvas-win32-x64-msvc updated from 0.1.100 to 1.0.13
- brace-expansion updated from 1.1.18 to 1.1.21
- brace-expansion updated from 2.1.4 to 2.1.7
- brace-expansion updated from 5.0.9 to 5.0.12
- es-toolkit updated from — to 1.52.0
- pdfjs-dist updated from 5.4.296 to 6.3.289
- prosemirror-view updated from 1.42.2 to 1.42.6
- undici updated from 6.28.0 to 6.29.1
- undici updated from 7.29.0 to 7.30.1
- undici updated from 8.10.0 to 8.12.3
- zod updated from 4.4.3 to 4.6.7
Pull Requests:
- fix(ingestion): confine feed execution identity to its creator rights (#18637) by Marie Flores (@marieflorescontact) in #18810
- fix(organization): improvement of organization segregation (#18652) by Céline Sèbe (@CelineSebe) in #18814
- fix(front): css properties updated (#17622) by Céline Sèbe (@CelineSebe) in #18952
- chore(deps): updates for LTS 7.260811.0 (#18938) by Marie Flores (@marieflorescontact) in #18940
- fix(stream): filter merge event sources according to user access (#18954) by Marie Flores (@marieflorescontact) in #18970
- chore(ci): fix all unbuntu runner to 26 (#19029) by A. Jard (@aHenryJard) in #19040
- fix(refactor): refacto file handling (#18757) by Jeremy Cloarec (@JeremyCloarec) in #18941
- fix(feed): refactor rolling feeds (#18618) by Jeremy Cloarec (@JeremyCloarec) in #18943
- fix(docker): upgrade system packages in the platform and worker images (#19155) by Xavier Fournet (@xfournet) in #19168
- perf(safe-ejs): render templates on a pool of workers (#18458) by Xavier Fournet (@xfournet) in #19185
- fix(users): list grantable groups when an organization admin creates user (#19126) by Marie Flores (@marieflorescontact) in #19166
- fix(segregation): do not match inaccessible connected elements when searching relationships (#19157) by Jeremy Cloarec (@JeremyCloarec) in #19194
- feat(xtm-hub): add a parameter to the XTM Hub browser messages (#19066) by Sébastien Wauquier (@fellowseb) in #19188
- fix(user): apply orga admin group checks when removing a user relation (#19308) by Marie Flores (@marieflorescontact) in #19322
- fix(chatbot): improve request handling of the chatbot file upload (#19333) by Ludovic Bouges (@ludovic) in #19345
- fix(filters): improve wildcard filter operator queries (#19314) by Archidoit in #19350
- chore(deps): security updates for LTS 7.260811.0 (#19217) by app-pr-write-for-lts-updates[bot] in #19407
- chore(frontend): improve vite environment loading (#19414) by Ludovic Bouges (@ludovic) in #19426
- fix(stream): restrict origin attributes published in live streams (#18829) by Marie Flores (@marieflorescontact) in #19442
- fix(auth): harmonize redirect handling across authentication endpoints (#19475) by Marie Flores (@marieflorescontact) in #19550
- chore(deps): update graphql-tools to utils 12.1.0 (#19525) by A. Jard (@aHenryJard) in #19539
- chore(deps): update follow-redirects, body-parser and zod (#19525) by A. Jard (@aHenryJard) in #19537
- chore(deps): update react-pdf to 11.0.0 (#19525) by A. Jard (@aHenryJard) in #19538
- fix(artifact): limit extracted size on artifact import (#18949) by Marie Flores (@marieflorescontact) in #19027
- fix(ingestion): run JSONPath script expressions in a worker pool with a timeout (#19484) by Terry PASQUET (@tpasquet) in #19552
- fix(drafts): validate draft context in TAXII and HTTP routes to prevent unauthorized access (#18258) by Florian DeLemarre (@delemaf) in #19530
Full Changelog: 7.260811.0-lts.1...7.260811.0-lts.2