# 3.0.1: Security and bug fixes

**URL:** <https://meta.discourse.org/t/3-0-1-security-and-bug-fixes/252902>\
**Category:** Announcements\
**Tags:** release-notes\
**Created:** [January 25, 2023, 7:46pm UTC](https://meta.discourse.org/t/3-0-1-security-and-bug-fixes/252902 "2023-01-25T19:46:35Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)\
**Post date:** [January 25, 2023, 7:46pm UTC](https://meta.discourse.org/t/3-0-1-security-and-bug-fixes/252902/1 "2023-01-25T19:46:35Z")

</div>

## Discourse 3.0.1 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on _lack of change_ than _lack of bugs_ - all releases, including those on tests-passed and beta are production ready.

### Changes

#### Security

- Prevent XSS in local oneboxes ([CVE-2023-22468](https://github.com/discourse/discourse/security/advisories/GHSA-8mr2-xf8r-wr8m))
- Exclude\_tags param could leak which topics had a specific hidden tag ([CVE-2023-23624](https://github.com/discourse/discourse/security/advisories/GHSA-qgj5-g5vf-fm7q))
- Only show restricted tag lists to authorized users ([CVE-2023-23620](https://github.com/discourse/discourse/security/advisories/GHSA-hvj9-g84x-5prx))
- Prevent ReDoS in user agent parsing ([CVE-2023-23621](https://github.com/discourse/discourse/security/advisories/GHSA-mrfp-54hf-jrcv))
- Prevent ReDOS by making the SSH url regex unambiguous (CVE pending)
- Remove bypass for base\_url ([CVE-2023-23615](https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8))
- Limit the character count of group membership requests ([CVE-2023-23616](https://github.com/discourse/discourse/security/advisories/GHSA-6xff-p329-9pgf))
- Limit the length of drafts ([CVE-2023-22739](https://github.com/discourse/discourse/security/advisories/GHSA-rqgr-g6v7-jcfc))
- Limit chat drafts length and preloaded count ([CVE-2023-22740](https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224))
- Bump Rails to v7.0.4.1 (see [rubyonrails.org](https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released) announcement)
- Default tags to show count of topics in unrestricted categories (CVE pending)

#### Bug Fixes

- Text selection breaks opening of links in new tabs
- Do not add empty use/svg tags in ExcerptParser
- Skip email if blank while syncing SSO attributes.
- TL4 user is not redirected to latest when delete topic
- Do not count deleted post for upload ref security
- Adds negative skidding to popper offset
- Data-popper-reference-hidden too broad
- Fix margin on mini-tag-chooser
- Prevents msg-actions to show hover text
- Generates automatic slug for trashed channels
- TL4 user can see deleted topics
- Allow modals to scroll on mobile when keyboard is open
- Don’t display staff-only options to non-staff in group member bulk menu
- Move min tag setting to tags section in edit category
- Deleted misconfigured embeddable hosts
- Query UploadReference in UploadSecurity for existing uploads
- Switch email domain site settings type to host\_list
- Do not override channel name when category selected
- Enqueue notify\_mailing\_list\_subscribers when post is recovered
- Change wording from title -\>` name in channel about page
- New hashtag support for narrative bot advanced narrative
- Validate tags parameter of TopicQuery
- Fix incorrect hashtag setting migration
- Use hashtags in channel archive PMs if available
- Add migration to reindex invalid indexes
- Ensure poll extraction is not attempted if post body is absent
- Preload user sidebar attrs when `?enable_sidebar=1`
- Prevent concurrent updates to top\_topics
- Ruby 2 backward compatible plugin logout redirect
- Fix flaky test resulting from PostAlerter keyword arguments
- Improve error reporting and failure modes for channel archiving
- Regression in TopicTrackingState MessageBus message scope. (#19835)

---

_[View the full topic](https://meta.discourse.org/t/3-0-1-security-and-bug-fixes/252902)._