|
Release date |
|
|---|---|
|
Release type |
maintenance |
|
Highlights |
Security updates |
📝 Summary
Security-focused backport release addressing cryptographic vulnerabilities and cross-site scripting (XSS) risks.
✨ Improvements
-
Enhanced Credential Security: Upgraded the encryption scheme for stored API tokens and passwords from AES-ECB to AES-GCM. This includes the use of randomized IVs to prevent pattern matching and a new, non-predictable secret key derivation.
-
Automatic Credential Migration: Introduced a transparent migration path that automatically upgrades legacy encrypted credentials to the new secure format upon their first use.
-
XSS Mitigation in Automation: Resolved stored cross-site scripting (XSS) vulnerabilities within Automation Rules. User-controlled inputs in rule names and descriptions are now properly sanitized and escaped.
-
Secure Data Export: Corrected export functionality (CSV/JSON/XML) to ensure that exported automation rules do not contain active XSS vectors.