RunOnFlux/flux v8.3.0

on GitHub

v8.3.0 Release

This release includes several important features, security enhancements, and bug fixes.

🚀 New Features

Database Persistence for Geolocation and Benchmark Data

• Implemented persistent storage for geolocation service data in MongoDB, reducing redundant API calls when data is already available
• Added benchmark results storage in the database for improved data persistence and retrieval
• New database collections: geolocation and benchmark configured in default settings

Designated User App Subscription Extension

• Added capability for designated users to extend app subscriptions on behalf of app owners
• New usersToExtend configuration allows specified addresses to sign expire-only updates
• Supports both standard and enterprise apps
• Includes isExpireOnlyUpdate() validation to ensure designated users can only modify expiration-related fields

Enhanced Host Info Service

• Added benchmark information to the host info service endpoint
• Provides more comprehensive node status data for network monitoring

🔒 Security Enhancements

Hardened Filesystem Path Validation

• Added symlink-aware path validation to prevent directory traversal attacks
• Implemented verifyRealPath and verifyRealPathOfExistingPath utilities from pathSecurity module
• Enhanced path verification in:
  • File upload operations (IOUtils.js)
  • App folder queries (fileQueryService.js)
  • Rename and remove operations (fileSystemManager.js)
• Fixed edge cases in path checking logic

🐛 Bug Fixes

Enterprise v8 Apps Renewal Price Calculation

• Fixed renewal price calculation for v8 enterprise apps
• Added proper decryption of encrypted specifications before price calculation

⚡ Performance Improvements

• Reduced redundant geolocation update calls when data is already cached
• Converted geolocation functions to async/await pattern for better performance and consistency

📁 Files Changed (25 files, +594 −89)

Core Services:

• ZelBack/config/default.js - New collection configs and usersToExtend list
• ZelBack/src/services/IOUtils.js - Path verification in file uploads
• ZelBack/src/services/appLifecycle/appInstaller.js - Async geolocation checks
• ZelBack/src/services/appLifecycle/appSpawner.js - Async geolocation calls
• ZelBack/src/services/appMessaging/messageVerifier.js - Designated user extension support
• ZelBack/src/services/appQuery/fileQueryService.js - Path traversal prevention
• ZelBack/src/services/appRequirements/hwRequirements.js - Async geolocation functions
• ZelBack/src/services/appSystem/fileSystemManager.js - Symlink-aware validation
• ZelBack/src/services/appSystem/systemIntegration.js - Async geolocation support

Configuration:

• package.json - Version bump to 8.3.0

Tests:

• Multiple test files updated to accommodate async function changes

🔗 Related PRs

• #1639 - Enterprise apps renewal pricing
• #1640 - Filesystem path hardening
• #1641 - User subscription extension delegation
• #1642 - Benchmark data in host info endpoint
• #1643 - Geolocation and benchmark database persistence