# 3.2.1: Security and bug fix release
**URL:** https://meta.discourse.org/t/3-2-1-security-and-bug-fix-release/298237
**Category:** Announcements
**Tags:** release-notes
**Created:** [March 15, 2024, 7:41am UTC](https://meta.discourse.org/t/3-2-1-security-and-bug-fix-release/298237 "2024-03-15T07:41:07Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [March 15, 2024, 7:41am UTC](https://meta.discourse.org/t/3-2-1-security-and-bug-fix-release/298237/1 "2024-03-15T07:41:07Z")
## Discourse 3.2.1 Stable Release
Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on _lack of change_ than _lack of bugs_ - all releases, including those on tests-passed and beta are production ready.
## Security Updates
This release includes fixes for these security issues reported by our community and [HackerOne](https://hackerone.com/discourse).
- Disclosure of the existence of secret subcategories [(CVE-2024-24748)](https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x)
- DoS via Pixel Flood [(CVE-2024-24827)](https://github.com/discourse/discourse/security/advisories/GHSA-58vw-246g-fjj4)
- DoS via invite - no max field size [(CVE-2024-27085)](https://github.com/discourse/discourse/security/advisories/GHSA-cvp5-h7p8-mjj6)
- DoS via Staff Actions Logs [(CVE-2024-27100)](https://github.com/discourse/discourse/security/advisories/GHSA-xq4v-qg27-gxgc)
- Disclosure of the existence of secret categories with custom backgrounds [CVE-2024-28242](https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23)
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [March 15, 2024, 12:06pm UTC](https://meta.discourse.org/t/3-2-1-security-and-bug-fix-release/298237/3 "2024-03-15T12:06:35Z")
### Even more!
But wait, there’s more! We do our best to highlight new features and changes for you, but there’s always too many changes to detail. For a full list of new features, bug fixes, UX improvements, and more, be sure to review the Additional Features and Fixes listed below.
## Plugin improvements
### discourse-activity-pub
#### Bug Fixes
- Ensure topic collections exists for full\_topic activities ([67](https://github.com/discourse/discourse-activity-pub/pull/67))
- Use full slugPath to reload categories with permissions ([65](https://github.com/discourse/discourse-activity-pub/pull/65))
- Delivery job failure log ([64](https://github.com/discourse/discourse-activity-pub/pull/64))
### discourse-adplugin
#### New Features
- Improve DFP / Ad-manager Content-Security-Policy compat ([201](https://github.com/discourse/discourse-adplugin/pull/201))
#### Bug Fixes
- Calculate no ads for groups server side ([200](https://github.com/discourse/discourse-adplugin/pull/200))
- Add exclude groups for each ad platforms ([197](https://github.com/discourse/discourse-adplugin/pull/197))
### discourse-ai
#### New Features
- Share conversations with AI via a URL ([521](https://github.com/discourse/discourse-ai/pull/521))
- AI Quick Semantic Search ([501](https://github.com/discourse/discourse-ai/pull/501))
- Add GitHub Helper AI Bot persona and tools ([513](https://github.com/discourse/discourse-ai/pull/513))
- Support for claude opus and sonnet ([508](https://github.com/discourse/discourse-ai/pull/508))
- Option for AI triage to send a post to the review queue ([498](https://github.com/discourse/discourse-ai/pull/498))
- AI helper support in non English languages ([489](https://github.com/discourse/discourse-ai/pull/489))
- Handle secure uploads in image caption ([476](https://github.com/discourse/discourse-ai/pull/476))
- AI image caption ([470](https://github.com/discourse/discourse-ai/pull/470))
- New Discourse Helper persona ([473](https://github.com/discourse/discourse-ai/pull/473))
- Mentionable personas and random picker tool, context limits ([466](https://github.com/discourse/discourse-ai/pull/466))
- Allow personas to supply top\_p and temperature params ([459](https://github.com/discourse/discourse-ai/pull/459))
- Fine tune llm report to follow instructions more closely ([451](https://github.com/discourse/discourse-ai/pull/451))
#### Bug Fixes
- Syntax highlighting for shared-ai conversions with CSP enabled ([532](https://github.com/discourse/discourse-ai/pull/532))
- Handle unicode on tokenizer ([515](https://github.com/discourse/discourse-ai/pull/515))
- Expire assets when CSS changes
- Missing translation on share page ([528](https://github.com/discourse/discourse-ai/pull/528))
- Don’t show share conversation incorrectly ([526](https://github.com/discourse/discourse-ai/pull/526))
- Filter soft-deleted topics when backfilling sentiment ([527](https://github.com/discourse/discourse-ai/pull/527))
- Ai-image-caption should not crash on checking currentUser can\_use\_assistant ([523](https://github.com/discourse/discourse-ai/pull/523))
- Image caption feature should respect composer AI helper groups ([522](https://github.com/discourse/discourse-ai/pull/522))
- Tune function calling ([519](https://github.com/discourse/discourse-ai/pull/519))
- Improve AI persona editor inputs and optional GitHub auth ([518](https://github.com/discourse/discourse-ai/pull/518))
- Prevent AI chat thread titles from being created before replies are posted ([517](https://github.com/discourse/discourse-ai/pull/517))
- Avoid all bot feedback loops ([507](https://github.com/discourse/discourse-ai/pull/507))
- Backspace in composer custom prompt closes menu ([505](https://github.com/discourse/discourse-ai/pull/505))
- System persona non English save, missing bot pms
- Support multiple tool calls ([502](https://github.com/discourse/discourse-ai/pull/502))
- Stream messages when directly PMing a persona ([500](https://github.com/discourse/discourse-ai/pull/500))
- Support spaces within arguments for Open AI ([499](https://github.com/discourse/discourse-ai/pull/499))
- Composer service call breaking shared edits ([494](https://github.com/discourse/discourse-ai/pull/494))
- Lower truncation size for Gemini Embeddings ([493](https://github.com/discourse/discourse-ai/pull/493))
- Image generation in gemini was broken ([490](https://github.com/discourse/discourse-ai/pull/490))
- Caption was broken with multiple subsequent calls ([481](https://github.com/discourse/discourse-ai/pull/481))
- Unable to share conversations with persona user ([479](https://github.com/discourse/discourse-ai/pull/479))
- Cleanup AI search results when a subsequent search happens ([469](https://github.com/discourse/discourse-ai/pull/469))
- Better AI chat thread titles ([467](https://github.com/discourse/discourse-ai/pull/467))
- Use a dedicated prompt for thread titles ([464](https://github.com/discourse/discourse-ai/pull/464))
- Explicit check for empty string in compat migration ([463](https://github.com/discourse/discourse-ai/pull/463))
- Hide related topics when module is disabled ([461](https://github.com/discourse/discourse-ai/pull/461))
- Typo causing text\_embedding\_3\_large to fail ([460](https://github.com/discourse/discourse-ai/pull/460))
- Improve embedding generation ([452](https://github.com/discourse/discourse-ai/pull/452))
- Add table name to remove ambiguous column reference in SQL ([449](https://github.com/discourse/discourse-ai/pull/449))
#### UX Changes
- Add title suffix to shared AI pages ([531](https://github.com/discourse/discourse-ai/pull/531))
- Add support for dark mode ([529](https://github.com/discourse/discourse-ai/pull/529))
- Update styles and markup for share feature ([525](https://github.com/discourse/discourse-ai/pull/525))
- AI Helper positioning ([506](https://github.com/discourse/discourse-ai/pull/506))
- Minor adjustments for image caption size, behavior ([484](https://github.com/discourse/discourse-ai/pull/484))
- Minor image caption style adjustments ([482](https://github.com/discourse/discourse-ai/pull/482))
- Add missing settings descriptions ([465](https://github.com/discourse/discourse-ai/pull/465))
- Re-introduce embedding settings validations ([457](https://github.com/discourse/discourse-ai/pull/457))
- Validate embeddings settings ([455](https://github.com/discourse/discourse-ai/pull/455))
#### Security Changes
- Place a SSRF protection when calling services from the plugin. ([485](https://github.com/discourse/discourse-ai/pull/485))
### discourse-akismet
#### Bug Fixes
- 500 Error when editing a PostVotingComment ([127](https://github.com/discourse/discourse-akismet/pull/127))
- Missing translation for review\_tl1\_users\_first\_post\_voting\_comment ([128](https://github.com/discourse/discourse-akismet/pull/128))
### discourse-automation
#### New Features
- Allow either custom\_fields or user\_fields in trigger ([253](https://github.com/discourse/discourse-automation/pull/253))
- Automated Post creation on user updated ([249](https://github.com/discourse/discourse-automation/pull/249))
#### Bug Fixes
- Update how we pass values to `ModalJsonSchemaEditor` ([257](https://github.com/discourse/discourse-automation/pull/257))
- Correctly format placeholders ([255](https://github.com/discourse/discourse-automation/pull/255))
- Computes next daily recurring from now ([248](https://github.com/discourse/discourse-automation/pull/248))
### discourse-cakeday
#### UX Changes
- Fix page layout, clean up ([123](https://github.com/discourse/discourse-cakeday/pull/123))
### discourse-calendar
#### New Features
- Use new options from downloadCalendar ([549](https://github.com/discourse/discourse-calendar/pull/549))
#### Bug Fixes
- Editing custom field of event didn’t work ([550](https://github.com/discourse/discourse-calendar/pull/550))
- Update test for holiday adjustments ([541](https://github.com/discourse/discourse-calendar/pull/541))
#### Security Changes
- Hide invitees from users who are not allowed to see the event post ([544](https://github.com/discourse/discourse-calendar/pull/544))
- Disallow self invite to private events ([543](https://github.com/discourse/discourse-calendar/pull/543))
### discourse-client-performance
#### Bug Fixes
- Use the proper plugin name in PLUGIN\_NAME
### discourse-data-explorer
#### New Features
- Add group\_list parameter type ([283](https://github.com/discourse/discourse-data-explorer/pull/283))
### discourse-global-filter
#### Bug Fixes
- Empty category matrix by converting it to glimmer ([133](https://github.com/discourse/discourse-global-filter/pull/133))
### discourse-group-membership-ip-block
#### Security Changes
- Don’t expose custom fields from other plugins ([13](https://github.com/discourse/discourse-group-membership-ip-block/pull/13))
### discourse-jira
#### Bug Fixes
- Update jira field to Component API. ([61](https://github.com/discourse/discourse-jira/pull/61))
- Typo ([58](https://github.com/discourse/discourse-jira/pull/58))
### discourse-kolide
#### New Features
- New checkbox to mark a device as mobile in onboarding ([89](https://github.com/discourse/discourse-kolide/pull/89))
### discourse-math
#### UX Changes
- Hide mathjax loading toast ([78](https://github.com/discourse/discourse-math/pull/78))
### discourse-microsoft-auth
#### Security Changes
- Emails from microsoft are not verified ([72](https://github.com/discourse/discourse-microsoft-auth/pull/72))
### discourse-multilingual
#### Bug Fixes
- Failing tests due to i18n.default ([3](https://github.com/discourse/discourse-multilingual/pull/3))
#### Security Changes
- Add max length to content\_languages custom field
### discourse-oauth2-basic
#### New Features
- Allow specifiying required paths when retrieving userinfo ([96](https://github.com/discourse/discourse-oauth2-basic/pull/96))
### discourse-post-voting
#### Bug Fixes
- Next Page issues with crawlers ([193](https://github.com/discourse/discourse-post-voting/pull/193))
### discourse-reactions
#### New Features
- Count all reactions as likes with exceptions controlled by a site setting ([267](https://github.com/discourse/discourse-reactions/pull/267))
#### Bug Fixes
- Stop requesting more reactions when none exist ([282](https://github.com/discourse/discourse-reactions/pull/282))
- Do not show Likes on reactions-received endpoint ([279](https://github.com/discourse/discourse-reactions/pull/279))
- View activity reactions for other users ([278](https://github.com/discourse/discourse-reactions/pull/278))
- \_allowHover() function call ([277](https://github.com/discourse/discourse-reactions/pull/277))
- Hovering reaction icon causing error would flood AJAX requests ([274](https://github.com/discourse/discourse-reactions/pull/274))
- Do not show users who Reacted under post … menu ([275](https://github.com/discourse/discourse-reactions/pull/275))
- Do not show likes with reactions on likes-received list ([273](https://github.com/discourse/discourse-reactions/pull/273))
- Handle null post.user\_id for UserAction sync ([270](https://github.com/discourse/discourse-reactions/pull/270))
- Require missing scheduled job in plugin.rb ([269](https://github.com/discourse/discourse-reactions/pull/269))
### discourse-solved
#### Bug Fixes
- Nest combobox within LI element ([280](https://github.com/discourse/discourse-solved/pull/280))
### discourse-steam-login
#### Bug Fixes
- Button styling and label ([79](https://github.com/discourse/discourse-steam-login/pull/79))
### discourse-subscriptions
#### Bug Fixes
- Ensure deletion of product upon confirmation ([195](https://github.com/discourse/discourse-subscriptions/pull/195))
### discourse-templates
#### New Features
- Add a link to template source topic ([70](https://github.com/discourse/discourse-templates/pull/70))
#### Bug Fixes
- Slowness when listing templates and the templates category ([67](https://github.com/discourse/discourse-templates/pull/67))
### discourse-vk-auth
#### UX Changes
- Improve button design to match other logins ([29](https://github.com/discourse/discourse-vk-auth/pull/29))
## All Features and Fixes
### New Features
- Auto generate and display video preview image ([25633](https://github.com/discourse/discourse/pull/25633))
- Site setting to include post in penalty messages ([26026](https://github.com/discourse/discourse/pull/26026))
### Bug Fixes
- Set the video background to be black ([25744](https://github.com/discourse/discourse/pull/25744))
- Add a boarder around the video placeholder play button ([25727](https://github.com/discourse/discourse/pull/25727))
- Video playback on iOS ([25513](https://github.com/discourse/discourse/pull/25513))
- Webauthn origin was incorrect for subfolder setups (#25651) ([25654](https://github.com/discourse/discourse/pull/25654))
- Correctly save group invites (stable) ([25567](https://github.com/discourse/discourse/pull/25567))
- Update themes javascript cache after running themes migrations ([25564](https://github.com/discourse/discourse/pull/25564))
- Site-setting integer input type ([25488](https://github.com/discourse/discourse/pull/25488))
### UX Changes
- Fix the video spinner css ([25770](https://github.com/discourse/discourse/pull/25770))
- Tweak play button css ([25754](https://github.com/discourse/discourse/pull/25754))
### Security Changes
- Limit invites params length
- Add rate limits for uploads
- Generate more category CSS on client
- Prevent large staff actions causing DoS
- Don’t disclose the existence of secret subcategories