This version contains JWT handling rewrite and several security fixes (GHSA-r64h-qmpx-3m36, GHSA-rg49-m6q7-w94p and GHSA-7949-4q4c-mp6h), thanks to @SounLabs and @0xnh4tty for the reports.
It also introduces a new environment variable JWT_SECRET_KEY, see documentation.
Note
- After the update, all logged-in users will be logged out.
- A message will appear on the Dashboard indicating that the privacy policy has been updated.
Security
- PR#1235 - JWT handling rewrite
- fix reset password reset by adding missing
typeclaim - fix OAuth2 client token revocation and lifecycle
- fix reset password reset by adding missing
- 01aab15 - check image pixels size
- 030f21e - return personal records and totals only for authenticated user
Enhancement
- PR#1235 - JWT handling rewrite
- move JWT to cookie and shorten JWT lifespan
- update privacy policy
Translations
- PR#1226 - Translations update from Hosted Weblate (Galician and German)
- PR#1227 - Translations update from Hosted Weblate (Croatian)
- PR#1234 - Translations update from Hosted Weblate (Chinese (Simplified Han script))
Translation status for languages available on the interface:
- Basque: 96%
- Bulgarian: 50%
- Catalan: 57%
- Chinese (Simplified): 99%
- Croatian: 99%
- Czech: 48%
- Dutch: 99%
- English: 100%
- French: 100%
- Galician: 99%
- German: 99%
- Italian: 97%
- Kabyle: 5%
- Norwegian Bokmål: 42%
- Polish: 99%
- Portuguese: 50%
- Russian: 94%
- Spanish: 66%
- Turkish: 3%
Deployment
- 52ae261 - update X-Forwarded-For in nginx example & API rate limits docs
- 18a9071 - fix http2 directive in nginx example
Thanks to the contributors: