# 3.0.0.beta16: Security release

**URL:** https://meta.discourse.org/t/3-0-0-beta16-security-release/250657
**Category:** Announcements
**Tags:** release-notes
**Created:** [January 5, 2023, 2:25am UTC](https://meta.discourse.org/t/3-0-0-beta16-security-release/250657 "2023-01-05T02:25:19Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [January 5, 2023, 2:25am UTC](https://meta.discourse.org/t/3-0-0-beta16-security-release/250657/1 "2023-01-05T02:25:19Z")

</div>

### Security Updates

This beta includes 8 security fixes for issues reported by our community and [HackerOne](https://hackerone.com/discourse).

### Security

- BCC active user emails from group SMTP [CVE-2022-46168  
 ](https://github.com/discourse/discourse/security/advisories/GHSA-8p7g-3wm6-p3rm)
- Sanitize PendingPost titles before rendering to prevent XSS [CVE-2023-22454](https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462)
- Don’t expose user post counts to users who can’t see the topic [CVE-2023-22453](https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv)
- Escape quotes in tag description when rendering [CVE-2023-22455](https://github.com/discourse/discourse/security/advisories/GHSA-5rq6-466r-6mr9)
- Check the length of raw post body to prevent max\_length bypass [CVE-2022-23549](https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xp)
- Delete email tokens when a user’s email is changed or deleted [CVE-2022-46177](https://github.com/discourse/discourse/security/advisories/GHSA-5www-jxvf-vrc3)
- Use rstrip instead of regex gsub to prevent ReDOS [CVE-2022-23548](https://github.com/discourse/discourse/security/advisories/GHSA-7rw2-f4x7-7pxf)
- Convert send\_digest to a post request [CVE-2022-23546](https://github.com/discourse/discourse/security/advisories/GHSA-q9jp-xv4g-328f)

#### Theme Component Security Updates

The mermaid theme component has also received a security fix. Be sure to update theme components in addition to Discourse.

- Render errors as plain text [CVE-2022-46180](https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3)

## Additional Features and Fixes

> **Click to expand**
>
> ### Features
> 
> - Make experimental hashtag autocomplete default for new sites
> 
> ### Bug Fixes
> 
> - Bookmark auto delete preference usage and default value
> - Check that the node has a src attr when getting size
> 
> ### UX Changes
> 
> - More descriptive sidebar titles, casing
> - Fix the positioning of topic admin popup menu
> - Remove unused strings
> - Fix for misalignment in autocomplete
> 
> ### Performance
> 
> - Use user-specific channel for message-bus logout