# 3.0.3: Security and bug fix release

**URL:** https://meta.discourse.org/t/3-0-3-security-and-bug-fix-release/262045
**Category:** Announcements
**Tags:** release-notes
**Created:** [April 18, 2023, 9:25am UTC](https://meta.discourse.org/t/3-0-3-security-and-bug-fix-release/262045 "2023-04-18T09:25:48Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![nat](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nat/32/235063_2.png) [@nat](https://meta.discourse.org/u/nat)
#### Post date: [April 18, 2023, 9:25am UTC](https://meta.discourse.org/t/3-0-3-security-and-bug-fix-release/262045/1 "2023-04-18T09:25:48Z")

</div>

## Discourse 3.0.3 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on _lack of change_ than _lack of bugs_ - all releases, including those on tests-passed and beta are production ready.

### Changes

### Bug Fixes

- Improve performance of UserStat.ensure\_consistency (#21044)

### Security Changes

- Encode embed URLs ([CVE-2023-29196](https://github.com/discourse/discourse/security/advisories/GHSA-986p-4x8q-8f48))
- Ensure site setting being updated is a configurable site setting ([CVE-2023-30606](https://github.com/discourse/discourse/security/advisories/GHSA-jj93-w3mv-3jvv))
- Strip `xlink:href` from uploaded SVGs ([CVE-2023-30538](https://github.com/discourse/discourse/security/advisories/GHSA-w5mv-4pjf-xj43))
- Update URI gem to 0.12.1 to address [CVE-2023-28755](https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/) ([Advisory](https://github.com/discourse/discourse/security/advisories/GHSA-h96p-fjq6-7jmg))
- Limit URL length for theme remote ([CVE-2023-28440](https://github.com/discourse/discourse/security/advisories/GHSA-vm65-pv5h-6g3w))