Security fixes, rate-limiting, metrics and upgrade to Perl 5.42.0

Today's update (e0705b8) brings with it the following changes:

Security issues

  • Fix cross-site-scripting vulnerability (XSS) in user profile about me section.
  • Fix cross-site-scripting vulnerability (XSS) in send_message(r).
  • Fix all user enumeration vulnerability in search user UI. Now it only searches your related users (e.g. from same institution).
  • Upgrade CPAN package CryptX to 0.087 to fix multiple security vulnerabilities.
  • Upgrade CPAN package Mozilla::CA to 20250602 to fix security vulnerability.
  • Upgrade CPAN package Log::Any to 1.718 to fix security vulnerability.

Performance improvements

  • Enable rate-limiting in web server to avoid denial-of-service attacks.

New features

  • Add RED Prometheus metrics for observability.
  • Add saturation Prometheus metrics for observability.
  • Add audit events Prometheus metrics for observability.
  • Protect information in the /metrics endpoint from the public for privacy.

Enhancements

  • Upgrade to latest stable version of Perl, 5.42.0.
  • Update all third-party CPAN packages to latest versions.
  • Use official Nginx packages instead of Ubuntu versions.
  • Use RenovateBot to keep third-party dependencies up to date.

Bugfixes

  • Moved WYSIWYG content editor buttons around to support smaller screens better.
Spinner

Login