🚨 PLEASE READ 🚨
This release contains a fix for a privately-reported security issue. The details of this are outlined in GHSA-v4g4-xqjg-59p6. A TLDR; for folks:
- A hypothetical attacker would need a server owner to explicitly create an API key for them, or have the means to steal their key (at which point, you may have larger problems)
- A non-owner user cannot create API keys without the corresponding permission, and even if permitted they wouldn't be able to create a key with server-owner-level permissions
- The actions that could be performed with the API key are only relevant to a multi-user Stump instance, and don't leak beyond the server itself (e.g., it only affects Stump and not the host machine)
If you are a server owner and have an API key that you have shared to another user, or suspect your key might have been exposed by some means, you should delete the key until 0.1.10 is released. If you trust your users or otherwise know your key is safe, or have no managed user accounts in your system, then proceed as you'd like.
What's Changed
- 🐛 Fix metadata editor delete squeezed against next tag by @balazs-szucs in #1431
- 🔖 Release v0.1.10 by @aaronleopold in #1435
Full Changelog: v0.1.9...v0.1.10