What's Changed
This release fixes 3 security issues including CVE-2026-86830 see also the AWS Security Bulletin. It is recommended to upgrade to this version or ensure any forked or derivative code is patched to incorporate the new fixes listed under Security fixes.
PR 605 specifically addresses this CVE.
Security fixes
- fix: derive accountName and role server-side by @tschia in #606
- fix: remove identity-pool IAM auth rules by @tschia in #605
- fix: restrict Settings.slackToken to admins by @tschia in #607
Performance improvements
- fix: improve Approve Requests page performance with byStatus GSI by @sejima1105 in #502
- perf(ui): query requests by status GSI instead of full-table scan by @bharatlakhiyani in #552
Bug fixes
- fix: retry SsoAdmin.ConflictException in Grant and Revoke state machines by @MalteGood in #515
- fix(teamListGroups): serialize datetime fields and remove outdated boto3 layer by @hanxs-aws in #560
This release also includes dependency updates.
New Contributors
- @sejima1105 made their first contribution in #502
- @hanxs-aws made their first contribution in #560
- @bharatlakhiyani made their first contribution in #552
Full Changelog: 1.5.0...v1.5.1