2.8.12: Security Release

[jomaxro (Joshua Rosenfeld)]

Discourse 2.8.12 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on lack of change than lack of bugs - all releases, including those on tests-passed and beta are production ready.

Changes

Security:

• Hide notifications for inaccessible topics CVE-2022-41944

Bug fix:

• Update GitImporter to match main

Performance:

• Correct should_skip? logic ins3:upload
• Updates3:expire_missing_assets to delete in batches

Plugin Security Updates

The Calendar plugin has also received a security fix. Be sure to update plugins in addition to Discourse.

• Calendar: Do not expose private group members CVE-2022-41913