Skip to content

CHANGELOG.md

Latest commit

 

History

History
283 lines (196 loc) · 10.9 KB

CHANGELOG.md

File metadata and controls

283 lines (196 loc) · 10.9 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

  • User and group management (#376)
  • Emergency Access: Allow a council to restore access to a orphaned vault (#390)
  • Show pictures of the groups in the Vaults member list (#375)
  • Allow admins to archive and unarchive any vault (#283, #430)
  • Disable users to exclude them from license seat count (#427, #428)
  • Display a banner to indicate that legacy devices are still in use, since these will be removed in the next major release (#420)
  • Published Helm chart (#406, #456)
  • Grace period after license expiry: vaults stay accessible during this period and a banner prompts to renew the license

Changed

  • Replace the top navigation bar with a sidebar
  • Updated Keycloak to 26.7.2
  • Updated to Java 25
  • Update Quarkus to 3.33.2.1 LTS
  • Improved browser locale detection (#371)
  • Improved efficiency of keycloak-to-hub data sync (#377)
  • Improved efficiency of group-based access permission checks (#372)
  • Migrated aes-siv and base encoding libraries to @noble/ciphers and @scure/base (#373)
  • New Flyway base migration B28 (#467)

Security

  • CVE-2025-64756, CVE-2025-64118: removed glob and tar dependencies
  • CVE-2025-64718, CVE-2025-62522: updated js-yaml and vite

Fixed

  • Check seat limit before unarchiving a vault, ensuring smooth operations without unexpectedly exceeding license limits (#431)
  • Creating user with sole role create-vault was unable to login due to missing role user
  • Fixed "Last Access" field (user detail page or admin device listing) was last date of any unlock attempt (#466)

1.4.7

Fixed

  • Update dependencies, primarily Quarkus, to version 3.20.6.1 to address the authentication and authorisation bypass vulnerability (CVE-2026-39852).

1.4.6

Changed

  • Updated Keycloak to 26.4.1
  • Update Quarkus to 3.20.3 LTS

Fixed

  • Show admin section of Hub when Keycloak version is not available (#361)

1.4.5

Fixed

  • Fix Session Expiration Not Enforced in Cryptomator Hub Web Client (GHSA-69fp-wc9g-5778)

1.4.4

Added

  • Breadcrumb Navigation
  • Unsaved changes notice with undo in the WOT settings
  • Support for regionalized translations
  • Latvian, Portuguese (Brazil), Russian, Ukrainian and Chinese (Taiwan) translation

Changed

  • Updated Keycloak to 26.3.2
  • Updated to Quarkus 3.20.2 LTS

Fixed

  • Bumped dependencies (fixes CVE-2025-7783, CVE-2025-53892, could not be exploited in Hub)

1.4.3

Changed

  • Updated Keycloak to 26.2.5
  • Updated to Quarkus 3.20.1 LTS

Fixed

  • Health check in Docker Compose not working due to curl missing from native images (#344, #249)
  • Bumped build time dependencies (fixes CVE-2025-5889, CVE-2025-46565, neither affected any Hub release)

1.4.2

Fixed

  • Fixed an issue where syncing of Keycloak users/groups would fail in very rare circumstances (#343)

1.4.1

Fixed

  • Fixed licence refresh, which had not been executed since version 1.4.0 (#341)

1.4.0

Added

  • This CHANGELOG file
  • WoT: Users will now have an ECDH as well as ECDSA key (#282)
  • WoT: Users can now mutually verify their identity, hardening Hub against injection of malicious public keys (#281)
  • WoT: Admins can adjust WoT parameters (#297)
  • Permission to create new vaults can now be controlled via the create-vaults role in Keycloak (#206)
  • Preserver user locale setting (#313)
  • New log event entries: UserAccountReset, UserKeysChange and UserSetupCodeChange (#310)
  • Audit log filter by event type (#312)
  • Show last IP address and last vault access timestamp of devices in user profile (#320)
  • Dutch, French, Italian, Korean, Portuguese and Turkish translation
  • Added provenance attestation for our container images (#322)
  • Show legacy devices in user profile (#331)
  • Show direct member count of groups in vault details (#329)

Changed

  • Updated Keycloak to 26.1.5
  • Updated to Java 21 (#272)
  • Updated to Quarkus 3.15.4 LTS
  • Updated to Tailwind CSS 4
  • Updated to Vite 6
  • Reduced number of transitive dependencies
  • Bumped build time dependencies
  • Migrated remaining commonjs modules in frontend build to ESM (#291)
  • Memoize infrequently changing data, reducing XHR roundtrips
  • Switched to JWK thumbprint format in user profile
  • Switched to Repository Pattern (#273)
  • Redesigned Admin Panel (#308)
  • Enhanced audit log VaultKeyRetrievedEvent, contains now IP address and device ID (#320)
  • Migrate syncer user to cryptomatorhub-system client (#336)

Fixed

  • Fixed incorrect ARIA roles improving accessibility
  • Fixed incorrect Content-Type header for /api/vaults/{vaultId}/access-token (#284)
  • Show legacy device name in audit log (#331)
  • Added "Browser Language" option to language selection dropdown, enabling users to revert to browser default language (#324)

Security

  • CVE-2023-45133: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  • CVE-2024-4067: Regular Expression Denial of Service (ReDoS) in micromatch
  • CVE-2024-4068: Uncontrolled resource consumption in braces
  • CVE-2024-21538: Regular Expression Denial of Service (ReDoS) in cross-spawn
  • CVE-2024-21539: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
  • CVE-2024-39338: Server-Side Request Forgery in axios
  • CVE-2024-45811: Vite's server.fs.deny is bypassed when using ?import&raw
  • CVE-2024-45812: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
  • CVE-2024-47068: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
  • CVE-2024-52809: vue-i18n has cross-site scripting vulnerability with prototype pollution
  • CVE-2024-52810: @intlify/shared Prototype Pollution vulnerability
  • CVE-2024-55565: Predictable results in nanoid generation when given non-integer values
  • CVE-2025-24010: Vite development server responded to arbitrary requests
  • CVE-2025-27597: Vue I18n Allows Prototype Pollution in handleFlatJson
  • CVE-2025-27152: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

1.4.0-rc3 (2025-03-27)

Changed

  • Migrate syncer user to cryptomatorhub-system client (#336)
  • Updated to Quarkus 3.15.4 LTS

1.4.0-rc2 (2025-03-17)

Added

  • Show direct member count of groups in vault details (#329)

Fixed

  • Added "Browser Language" option to language selection dropdown, enabling users to revert to browser default language (#324)
  • Reload device lists upon device removal
  • Added pointer cursor to device remove "button" text
  • Show device only when available in audit log vault key retrieve event

1.4.0-rc1 (2025-03-14)

Added

  • Show legacy devices in user profile (#331)

Changed

  • Updated to Quarkus 3.15.3.1 LTS
  • Updated Keycloak to 26.1.4

Fixed

  • Show legacy device name in audit log (#331)

Security

  • CVE-2025-27597: Vue I18n Allows Prototype Pollution in handleFlatJson
  • CVE-2025-27152: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

1.4.0-beta3 (2025-02-22)

Added

  • Audit log filter by event type (#312)
  • Show last IP address and last vault access timestamp of devices in user profile (#320)
  • Added provenance attestation for our container images (#322)

Changed

  • Updated to Quarkus 3.15.3 LTS
  • Enhanced audit log VaultKeyRetrievedEvent, contains now IP address and device ID (#320)

1.4.0-beta2 (2025-02-13)

Added

  • New log event entries: UserAccountReset, UserKeysChange and UserSetupCodeChange (#310)
  • WoT: Admins can adjust WoT parameters (#297)
  • Preserver user locale setting (#313)
  • Add Italian, Korean, Dutch and Portuguese translation

Changed

  • Updated Keycloak to 26.1.2
  • Updated to Quarkus 3.15.2 LTS
  • Updated to Tailwind CSS 4
  • Updated to Vite 6
  • Reduced number of transitive dependencies
  • Bumped build time dependencies
  • Redesigned Admin Panel (#308)

Security

  • CVE-2024-4067: Regular Expression Denial of Service (ReDoS) in micromatch
  • CVE-2024-21538: Regular Expression Denial of Service (ReDoS) in cross-spawn
  • CVE-2024-21539: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
  • CVE-2024-45811: Vite's server.fs.deny is bypassed when using ?import&raw
  • CVE-2024-45812: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
  • CVE-2024-47068: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
  • CVE-2024-52809: vue-i18n has cross-site scripting vulnerability with prototype pollution
  • CVE-2024-52810: @intlify/shared Prototype Pollution vulnerability
  • CVE-2024-55565: Predictable results in nanoid generation when given non-integer values
  • CVE-2025-24010: Vite development server responded to arbitrary requests

1.4.0-beta1 (2024-10-31)

Added

  • This CHANGELOG file
  • WoT: Users will now have an ECDH as well as ECDSA key (#282)
  • WoT: Users can now mutually verify their identity, hardening Hub against injection of malicious public keys (#281)
  • Permission to create new vaults can now be controlled via the create-vaults role in Keycloak (#206)

Changed

  • Updated Keycloak to 25.0.6
  • Updated to Java 21 (#272)
  • Updated to Quarkus 3.15.x LTS
  • Bumped build time dependencies
  • Migrated remaining commonjs modules in frontend build to ESM (#291)
  • Memoize infrequently changing data, reducing XHR roundtrips
  • Switched to JWK thumbprint format in user profile
  • Switched to Repository Pattern (#273)

Fixed

  • Fixed incorrect ARIA roles improving accessibility
  • Fixed incorrect Content-Type header for /api/vaults/{vaultId}/access-token (#284)

Security

  • CVE-2023-45133: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  • CVE-2024-4068: Uncontrolled resource consumption in braces
  • CVE-2024-39338: Server-Side Request Forgery in axios