|
1 | 1 | # Changelog |
2 | 2 |
|
3 | | -### (2025-09-03) What's new in **ROR 1.66.1** |
4 | | - |
5 | | - |
6 | | - **🚀New** (ES) 9.0.7, 8.18.7 support |
7 | | - |
8 | | - |
9 | | - **🐞Fix** (ES) [Patching issue in Elasticsearch 9.x, 8.19.x, and 8.18.x that caused startup failures on Java 17](https://forum.readonlyrest.com/t/ror-1-65-1-java-17/2841) |
| 3 | +* **🚀New** (ES) 9.0.7, 8.18.7 support |
| 4 | +* **🐞Fix** (ES) [Patching issue in Elasticsearch 9.x, 8.19.x, and 8.18.x that caused startup failures on Java 17](https://forum.readonlyrest.com/t/ror-1-65-1-java-17/2841) |
10 | 5 |
|
11 | 6 | ### (2025-08-28) What's new in **ROR 1.66.0** |
12 | 7 | <details> |
13 | 8 | <summary><strong>🚨Security Fix</strong> (KBN) <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-7339">CVE-2025-7339</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-7783">CVE-2025-7783</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-54419">CVE-2025-54419</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-9288">CVE-2025-9288</a></summary> |
14 | | -Addresses multiple critical security vulnerabilities in Node.js dependencies including header modification, HTTP parameter pollution, authentication bypass, and input validation issues. These updates prevent potential security exploits in the Kibana integration. |
| 9 | +Fixed multiple critical security vulnerabilities in dependencies including header modification, HTTP parameter pollution, authentication bypass, and input validation flaws. These updates prevent potential security exploits in the Kibana plugin. |
15 | 10 | </details> |
16 | 11 | <details> |
17 | 12 | <summary><strong>🚨Security Fix</strong> (KBN) <a href="https://forum.readonlyrest.com/t/hidden-functions-are-available-through-the-search/2840/2">Prevented visibility of hidden functions through Kibana UI search</a></summary> |
18 | | -Fixes a security issue where hidden functions and administrative features were inadvertently exposed through Kibana's search functionality, preventing unauthorized discovery of restricted capabilities. |
| 13 | +Addressed a security issue where hidden functions were unintentionally exposed through Kibana's UI search. This fix ensures functions marked as hidden remain properly concealed from user searches. |
19 | 14 | </details> |
20 | 15 | <details> |
21 | 16 | <summary><strong>🚨Security Fix</strong> (ES) Removed internal failure details from error responses to prevent unintended information disclosure</summary> |
22 | | -Enhances security by sanitizing error responses to exclude internal system details that could be exploited by attackers, preventing potential information leakage. |
| 17 | +Enhanced security by eliminating internal system details from error responses that could potentially expose sensitive information about the Elasticsearch cluster configuration. |
23 | 18 | </details> |
24 | 19 | <details> |
25 | 20 | <summary><strong>🚀New</strong> (KBN) 9.1.3, 9.1.2, 9.0.6, 8.19.3, 8.18.6 support</summary> |
26 | | -Adds official support for the latest Elasticsearch patch versions, ensuring compatibility with recent security updates and bug fixes from Elasticsearch. |
| 21 | +Added official support for the latest Kibana maintenance releases including versions 9.1.3, 9.1.2, 9.0.6, 8.19.3, and 8.18.6, ensuring compatibility with recent security patches. |
27 | 22 | </details> |
28 | 23 | <details> |
29 | 24 | <summary><strong>🚀New</strong> (ES) 9.1.3, 9.1.2, 9.0.6, 8.19.3, 8.18.6 support</summary> |
30 | | -Improves authentication flow by optimizing metadata selection to prioritize ACL blocks with Kibana index definitions, ensuring more consistent user session behavior. |
| 25 | +Extended compatibility to include Elasticsearch versions 9.1.3, 9.1.2, 9.0.6, 8.19.3, and 8.18.6, providing the latest security updates and performance improvements. |
31 | 26 | </details> |
32 | 27 | <details> |
33 | 28 | <summary><strong>🧐Enhancement</strong> (ES) Refined user metadata selection logic during login to prioritize matched blocks associated with a defined Kibana index</summary> |
34 | | -Enhances configuration reliability by improving how consent flags are processed when set through environment variables, preventing configuration issues. |
| 29 | +Improved the login process by optimizing user metadata selection to prioritize authentication blocks associated with configured Kibana indices for more reliable user sessions. |
35 | 30 | </details> |
36 | 31 | <details> |
37 | 32 | <summary><strong>🧐Enhancement</strong> (ES) Patching: improved handling of the consent flag when provided via environment variables for more reliable configuration</summary> |
38 | | -Fixes a bug that prevented proper index deletion operations through Kibana's Index Management interface, restoring full lifecycle management functionality. |
| 33 | +Enhanced configuration handling for consent flags specified through environment variables, ensuring consistent application of security settings across deployments. |
39 | 34 | </details> |
40 | 35 | <details> |
41 | 36 | <summary><strong>🐞Fix</strong> (KBN) Resolved issue with index deletion in <strong>Index Management</strong> via Kibana UI</summary> |
42 | | -Addresses inconsistent document visibility in Kibana's Discover tab when user ACLs include index definitions, ensuring proper rendering based on permissions. |
| 37 | +Fixed a bug that prevented proper index deletion operations through Kibana's Index Management interface when ReadonlyREST security rules were active. |
43 | 38 | </details> |
44 | 39 | <details> |
45 | 40 | <summary><strong>🐞Fix</strong> (KBN) Corrected document display in <strong>Discover</strong> when indices are defined in the user ACL block</summary> |
46 | | -Resolves a compatibility issue with Kibana 9.1.0 that prevented Space deletion, restoring full Spaces management functionality for administrators. |
| 41 | +Addressed an issue where document visibility in Kibana's Discover tab was incorrectly handled for users with ACL-defined indices. |
47 | 42 | </details> |
48 | 43 | <details> |
49 | 44 | <summary><strong>🐞Fix</strong> (KBN) Fixed an error preventing <strong>Spaces</strong> from being deleted in Kibana <strong>9.1.0</strong></summary> |
50 | | -Fixes configuration parsing issues when both ROR whitelisted paths and X-Pack security are enabled, ensuring proper path-based access control. |
| 45 | +Resolved a compatibility issue with Kibana 9.1.0 that was preventing administrators from deleting Spaces through the Kibana UI. |
51 | 46 | </details> |
52 | 47 | <details> |
53 | 48 | <summary><strong>🐞Fix</strong> (KBN) Corrected handling of <code>readonlyrest_kbn.whitelistedPaths</code> in <code>kibana.yml</code> when <code>xpack.security.enabled: true</code></summary> |
54 | | -Addresses compatibility problems causing startup failures in older Kibana versions 7.9.0-7.10.2, ensuring backward compatibility. |
| 49 | +Fixed configuration parsing for whitelisted paths when X-Pack security is enabled, ensuring proper path-based access controls in secured environments. |
55 | 50 | </details> |
56 | 51 | <details> |
57 | 52 | <summary><strong>🐞Fix</strong> (KBN) Resolved startup issues for Kibana versions <strong>7.9.0 → 7.10.2</strong></summary> |
58 | | -Resolves report generation failures when X-Pack security is enabled with encrypted saved objects, ensuring proper reporting functionality in secured environments. |
| 53 | +Addressed compatibility problems causing startup failures in older Kibana versions 7.9.0 through 7.10.2. |
| 54 | +</details> |
| 55 | +<details> |
| 56 | +<summary><strong>🐞Fix</strong> (KBN) Fixed report generation when <code>xpack.security.enabled: true</code> and <code>xpack.encryptedSavedObjects.encryptionKey</code> is set in Kibana <strong>8.19.x</strong> and <strong>9.1.x</strong></summary> |
| 57 | +Resolved an issue with report generation in secured Kibana environments where encrypted saved objects configuration was interfering with report creation. |
59 | 58 | </details> |
60 | | - |
61 | | - |
62 | | - **🐞Fix** (KBN) Fixed report generation when `xpack.security.enabled: true` and `xpack.encryptedSavedObjects.encryptionKey` is set in Kibana **8.19.x** and **9.1.x** |
63 | 59 |
|
64 | 60 | ### (2025-07-15) What's new in **ROR 1.65.1** |
65 | 61 | <details> |
|
0 commit comments