3.1.1: Security and bug fix release

News and Events Announcements

AI-generated summary

Discourse 3.1.1 is a stable release focused on security and bug fixes, with a recommendation for all sites to follow the tests-passed branch for production readiness. Key updates include a new silence reason dropdown for admin penalties, several bug fixes such as service-worker cache cleanup, iOS tag picker focus, and poll breakdown regressions. Performance improvements were made to topic list queries. Security enhancements address multiple CVEs: limiting drafts per user and draft_key length CVE-2023-38706, restricting TOTP/security key name lengths CVE-2023-40588, reducing SVG sprite cache size to prevent DoS CVE-2023-41043, and adding limits for themes and theme assets CVE-2023-41042.

1

Discourse 3.1.1 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on lack of change than lack of bugs - all releases, including those on tests-passed and beta are production ready.

Changes

New Features

  • Add silence reason dropdown to admin penalty reason

Bug Fixes

  • Tests
  • Ensure service-worker cache is cleaned correctly (stable) (23205)
  • Compact tag picker input not focused in iOS (#22922) (23090)
  • Poll breakdown regressions (22957)
  • Make poll breakdown modal closable again (22953)

Performance

  • Improve performance of queries when loading a topic list (#22949) (22950)

Security Changes

4 Likes