From 2cd41cd1100d1fc40182c78cf50a34b0b5345fb0 Mon Sep 17 00:00:00 2001 From: Daniel DeGroff Date: Mon, 25 Nov 2024 19:24:15 -0700 Subject: [PATCH 01/24] Release notes for 1.54.0 (#3406) * Release notes for 1.54.0 * reviewing * Add missing db migration notice * Fix linter errors that existed prior, so someone pushed a linter rule w/out correcting failures. --------- Co-authored-by: Andy Pai --- .../content/docs/operate/deploy/upgrade.mdx | 1 + .../src/content/docs/release-notes/index.mdx | 22 ++++++++++++++++--- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/astro/src/content/docs/operate/deploy/upgrade.mdx b/astro/src/content/docs/operate/deploy/upgrade.mdx index 1e9456d6af..22e29896c1 100644 --- a/astro/src/content/docs/operate/deploy/upgrade.mdx +++ b/astro/src/content/docs/operate/deploy/upgrade.mdx @@ -272,6 +272,7 @@ fusionauth-database-schema/ |-- 1.50.1.sql |-- 1.51.0.sql |-- 1.53.0.sql + |-- 1.54.0.sql ``` ## Rolling Back an Upgrade diff --git a/astro/src/content/docs/release-notes/index.mdx b/astro/src/content/docs/release-notes/index.mdx index 3de6064459..724776dd5f 100644 --- a/astro/src/content/docs/release-notes/index.mdx +++ b/astro/src/content/docs/release-notes/index.mdx @@ -44,6 +44,22 @@ import { YouTube } from '@astro-community/astro-embed-youtube'; Looking for release notes older than 1.44.0? Look in the [release notes archive](/docs/release-notes/archive). Looking to be [notified of new releases?](/docs/operate/roadmap/releases#release-notifications) + + + + +### Security +* + A vulnerability was discovered in the FusionAuth hosted pages. Under specific application configurations, and with insufficient authorization validation being performed on an access token, a malicious user could bypass required steps in post-authentication workflows, allowing unauthorized access to protected resources. + + This vulnerability was introduced in version `1.41.0`. It is recommended that you upgrade to version `1.54.0` at your earliest convenience. + + +### Fixed +* + The SCIM Groups API does not properly perform atomic updates to groups and members. This can lead to consistency issues when multiple SCIM update requests are simultaneously processed requiring membership changes. + + @@ -704,7 +720,7 @@ Update dependencies. ### Fixed * Revert the GC (garbage collection) logging change introduced in version `1.47.0` for compatibility with the FusionAuth docker image. - * Resolves [GitHub Issue #2392](https://github.com/FusionAuth/fusionauth-issues/issues/2392), thanks to [@pigletto](https://github.com/pigletto) and [@patricknwn](https://github.com/patricknwn) for reporting. + * Resolves [GitHub Issue #2392](https://github.com/FusionAuth/fusionauth-issues/issues/2392), thanks to [@pigletto](https://github.com/pigletto) and [@patricknwn](https://github.com/patricknwn) for reporting. @@ -758,7 +774,7 @@ Please be sure to read the notes in the **Changed** section before upgrading. federatedCSRFToken=""] ``` -3. Find the element `