# 2.9.0.beta13: תיקוני אבטחה, שיפורי סרגל צד, scopes חדשים ל-API ועוד

**URL:** https://meta.discourse.org/t/2-9-0-beta13-security-fixes-sidebar-improvements-new-api-scopes-and-more/246872
**Category:** Announcements
**Tags:** release-notes
**Created:** [28 בנובמבר,‏ 2022,‏ 12:50am UTC](https://meta.discourse.org/t/2-9-0-beta13-security-fixes-sidebar-improvements-new-api-scopes-and-more/246872 "2022-11-28T00:50:22Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [28 בנובמבר,‏ 2022,‏ 12:50am UTC](https://meta.discourse.org/t/2-9-0-beta13-security-fixes-sidebar-improvements-new-api-scopes-and-more/246872/1 "2022-11-28T00:50:22Z")

</div>

## New features in 2.9.0.beta13

### Security Updates

This beta includes 2 security fixes for issues reported by our community and [HackerOne](https://hackerone.com/discourse).

- Hide notifications for inaccessible topics [CVE-2022-41944](https://github.com/discourse/discourse/security/advisories/GHSA-354r-jpj5-53c2)
- Limit chat message char length [CVE-2022-41921](https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc)

#### Plugin Security Updates

The Calendar plugin has also received a security fix. Be sure to update plugins in addition to Discourse.

- Calendar: Do not expose private group members [CVE-2022-41913](https://github.com/discourse/discourse-calendar/security/advisories/GHSA-jh96-w279-g7r9)

### Sidebar narrow screen improvements

When desktop screen is narrow, the sidebar now behaves similar to mobile - hiding by default and appearing as a slide-in panel when opened.

 ![sidebar hidden](https://global.discourse-cdn.com/meta/original/4X/7/4/1/741c6f7d510ab1ee1e1df11cf31245e694121eac.png) ![sidebar slide-in](https://global.discourse-cdn.com/meta/original/4X/c/8/9/c892c668d47bb39b9b99f0481660f603be047c8b.png)

### User Status API

[User Status](https://meta.discourse.org/t/user-status/240335) now has a dedicated API scope for more secure integrations. For more details, see [this post](https://meta.discourse.org/t/user-status/240335/44)

### New site setting: `default composer category`

Admins can now configure the default category for the composer. The selected category will be pre-filled in the new topic composer. The setting applies when starting a topic from pages other than a category list. If creating a new topic while browsing a specific category, for example [https://meta.discourse.org/c/bug](https://meta.discourse.org/c/bug), the composer will pre-fill the category being viewed.

### New chat default: allow chat access for Trust Level 1 users

The `chat allowed groups` site setting controls which groups can access chat. Previously, only `@staff` had chat access by default. To make it easier for new sites to use chat, TL1 users now also have access out of the box.

### New Features

This release includes a number of additional smaller features, including:

- Allow setting `default_enabled` for badges
- Add descriptions on hover for hashtag search results
- Allow staff to flag chat messages
- API to update user’s [discourse connect](https://meta.discourse.org/t/13045?silent=true) external id
- Deprioritize like notifications on all list
- Add user tips for post and topic features
- Introduces `chat_max_direct_message_users` setting

---

_[View the full topic](https://meta.discourse.org/t/2-9-0-beta13-security-fixes-sidebar-improvements-new-api-scopes-and-more/246872)._