# 2.9.0.beta12: Security fix, bug fixes and more

**URL:** https://meta.discourse.org/t/2-9-0-beta12-security-fix-bug-fixes-and-more/245469
**Category:** Announcements
**Tags:** release-notes
**Created:** [November 14, 2022, 3:18am UTC](https://meta.discourse.org/t/2-9-0-beta12-security-fix-bug-fixes-and-more/245469 "2022-11-14T03:18:02Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [November 14, 2022, 3:18am UTC](https://meta.discourse.org/t/2-9-0-beta12-security-fix-bug-fixes-and-more/245469/1 "2022-11-14T03:18:02Z")

</div>

## New features in 2.9.0.beta12

### Security Updates

This beta includes two security fixes for issues reported by our community and [HackerOne](https://hackerone.com/discourse).

- Prevent email from being nil in InviteRedeemer [CVE-2022-39385](https://github.com/discourse/discourse/security/advisories/GHSA-gh5r-j595-qx48)
- Correctly render link title in draft preview [CVE-2022-46148](https://github.com/discourse/discourse/security/advisories/GHSA-c5h6-6gg5-84fh)

### New Features

This release includes a number of additional smaller features, including:

- Replyable chat push notifications
- Add cooked post to user archive exports
- Rename onboarding popups to user tips
- New site setting to hide user profiles by default.

---

_[View the full topic](https://meta.discourse.org/t/2-9-0-beta12-security-fix-bug-fixes-and-more/245469)._