# 3.0.5: Security and bug fix release

**URL:** https://meta.discourse.org/t/3-0-5-security-and-bug-fix-release/271302
**Category:** Announcements
**Tags:** release-notes
**Created:** [July 11, 2023, 11:21pm UTC](https://meta.discourse.org/t/3-0-5-security-and-bug-fix-release/271302 "2023-07-11T23:21:38Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [July 11, 2023, 11:21pm UTC](https://meta.discourse.org/t/3-0-5-security-and-bug-fix-release/271302/1 "2023-07-11T23:21:38Z")

</div>

## Discourse 3.0.5 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on _lack of change_ than _lack of bugs_ - all releases, including those on tests-passed and beta are production ready.

### Changes

#### Bug Fixes

- Fix broken topic embedding because of incomplete security patch

#### Security Changes

- limit amount of links in custom sidebar section [CVE-2023-36818  
 ](https://github.com/discourse/discourse/security/advisories/GHSA-gxqx-3q2p-37gm)
- Don’t reuse CSP nonce between requests [CVE-2023-36473](https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq)
- ensure topic is valid before updating category [CVE-2023-36466](https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932)
- ReDoS vulnerability in URI gem [Ruby CVE-2023-36617](https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/)