Security release. Please update.
Security
Fixes GHSA-p7w3-46pg-mv6h, a follow-up to yesterday's 3.38.1 release. Thanks to mansurmavlankulov for the report.
- Source and destination URLs stored through
POST /api/sources,PUT /api/sources/:idand the configuration save now go through the outbound guard: link local and cloud metadata addresses are refused, private networks stay allowed (#448) - The source fetch helper pins plain http to the checked address and no longer follows redirects, like the connection tests and the notification providers
- Source errors carry the URL and status only; the upstream response body never enters the message
- Errors raised by a request to another host are never forwarded to API clients, whatever words they contain
Full Changelog: v3.38.1...v3.38.2