This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven FaΓbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Page Content - As of this release, most types of form content are now removed from page content on render. If you applied customizations which made use of in-page form content, you may now need to find alternative methods.
Full List of Changes
Updated application PHP dependencies.
Updated session-based API authentication to only be active for GET requests.
Updated page content filtering to remove many common form elements & attributes.
Updated translations with latest Crowdin changes. (#5997)
Release Highlights: Although GeForce Game Ready Drivers and NVIDIA Studio Drivers can be installed on supported notebook GPUs, the original equipment manufacturer (OEM) provides certified drivers for your specific notebook on their website. NVIDIA recommends that you check with your notebook OEM for recommended software updates for your notebook.
Game Ready for ARC Raiders: Headwind Update
This new Game Ready Driver provides the best gaming experience for the latest new games supporting DLSS 4 technology including ARC Raiders: Headwind Update and Arknights: Endfield. In addition, there is Game Ready support for Highguard which features DLSS Super Resolution.
Fixed Gaming Bugs
Total War: Three Kingdoms: Artifacts may be observed during gameplay when Screen Space Reflections is enabled [5745647]
Fixed General Bugs
Color banding observed with SDR content when Windows Automatic Color Management enabled [5754551]
Asus G14 may freeze on startup when Asus Ultimate Mode is enabled [5754849]
Β The Stable channel has been updated to 145.0.7632.26/.27 for Windows andMac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in thelog.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.