- ⚠️ SECURITY UPDATE: Fixed two vulnerabilities. We thank @diptendukar for letting us know about these problems.
- A medium-severity vulnerability in the Editorial Workflow that let unreviewed files be published along with an entry, completing the fix for GHSA-8h97-74c4-g246. The checks before publishing went by file paths alone in a few cases, so a pull or merge request could still add or replace any file in a media folder, or change the entries rewritten or moved along with a renamed, moved or deleted entry, without the reviewer seeing it.
- A low-severity ReDoS vulnerability that allowed content to freeze the CMS when searching entries.
- Publishing an entry now also checks that the files its request adds to or replaces in a media folder are used by the entry, that the entries rewritten or moved along with it are exactly as the CMS writes them, and that the entry is still the version you reviewed. A file the entry no longer uses, such as an image removed from the entry after it was saved, has to be taken off the request before the entry can be published. See Checks Before Publishing.
As always, we recommend using the latest version of Sveltia CMS to benefit from improvements.
Full Changelog: v0.253.0...v0.253.1