This release mitigates a potential security issue with the image endpoint. In short, an attacker can inject query parameters and make proxied requests to arbitrary URLs. See the security advisory for details.

Also there are fixes for the database connection pool. The pool size is now at least two, as a lower size can result in deadlocks. Additionally there are now connection timeouts added. If your server logs show pool timeout errors, you should increase database.pool_size in the Lemmy config.

  • Fix for image proxy filetypes by @dessalines in #6357
  • Enable DB connection timeout by @Nutomic in #6355
  • Use min database pool size of 2. by @dessalines in #6345

https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
6 comments in c/announcements@lemmy.ml view that post
[–] 3 points 8 months ago* (1 child)

Does this build have the vote traffic updates mentioned in this thread or will that come in a later/bigger release?

As always thank you all for the hard work that goes into building and maintaining this project. 💚

  • source
  • hideshow 1 child comment
  • [–] 2 points 8 months ago

    let's gooooooooooo

  • source
  • [–] 2 points 8 months ago (1 child)

    The security advisory is not viewable

  • source
  • hideshow 1 child comment