3.4.2: Security and bug fix release

Discourse 3.4.2 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on lack of change than lack of bugs - all releases, including those on tests-passed and beta are production ready.

Security Updates

This release includes fixes for these security issues reported by our community and HackerOne.

1 Like

Even more!

But wait, there’s more! We do our best to highlight new features and changes for you, but there’s always too many changes to detail. For a full list of new features, bug fixes, UX improvements, and more, be sure to review the Additional Features and Fixes listed below.

Plugin improvements

discourse-activity-pub

New Features

  • Add support for Service actors (196)
  • Add ActivityPub about route with basic actor listing (191)

Bug Fixes

  • Improve base_object_id parsing (198)
  • Incorrect actor attributes (194)
  • Always prevent AP publishing from a read restricted category (181)
  • Don’t show publish all posts when topic is first_post publish type (180)

discourse-ai

New Features

  • Allow specifying tool use none in completion prompt
  • Silent triage using ai persona (1193)
  • Allow disabling of top_p and temp for thinking models (1184)
  • Add ability to disable search discoveries (1177)
  • Add persona-based replies and whisper support to LLM triage (1170)
  • Automation triage using personas (1126)
  • Implement thinking token support (1155)
  • Full support for Sonnet 3.7 (1151)

Bug Fixes

  • Prevents to call Object.keys on null (1217)
  • Unable to click doughnut when no filters (1213)
  • Bump system prompt limit (1210)
  • Remove incorrect full-page-search app event (1209)
  • Ensure that we shutdown thread pool (1207)
  • Prevents fields in Object to re-render (1205)
  • Failing image caption spec (1195)
  • Need to create model when testing new embedding (1192)
  • Various issues with llm and triage management (1186)
  • AI triage support and refactor search functionality (1175)
  • Prevents double escaping of filters (1179)
  • Use route for admin sentiment sidebar links (1160)
  • Subsequent results in full page search should re-trigger discovery (1156)
  • Legacy reasoning models not working, missing provider params (1149)

UX Changes

  • Convert sentiment analysis overview to horizontal bars (1216)
  • Try AI search to side on large screens (1196)
  • Add links to sentiment to admin sidebar (1158)
  • Update Sambanova LLM templates (1157)
  • Smoother streaming for discoveries (1154)
  • Add description to configuration nav (1153)
  • Improvements to sentiment analysis report (1150)

Performance

  • Move sentiment analysis to “low” sidekiq queue (1173)

discourse-akismet

New Features

  • Send email to deleted user (167)

discourse-algolia

UX Changes

  • Remove old Algolia forum link from README (118)

discourse-assign

New Features

  • Add “assigned:<name>” filter (in the /filter page) (648)

Bug Fixes

  • Incorrect ussage of prioritize_full_name_in_ux replaced by prioritize_username_in_ux (645)
  • Ensure assign plugin respects prioritize_full_name_in_ux site setting (632)
  • Allow user to be assigned to post and topic (638)

UX Changes

  • Add class to assign topic list items (649)
  • Following 08d99dc, we can remove the separate color assignment (647)
  • Update for new core tag separator (639)

discourse-authentication-validations

Bug Fixes

  • Broken specs due to admin path change (34)

discourse-cakeday

Bug Fixes

  • Respect user’s hide profile when showing their birthdate & cakeday (152)

discourse-calendar

New Features

  • Add plugin outlet in modal/post-event-builder (693)

Bug Fixes

  • Decrease height of the calendar scroller. (709)
  • Border-radius fix (696)

Performance

  • Fix N+1 problem on DiscoursePostEvent::EventsController#index (698)

discourse-chat-integration

Bug Fixes

  • Sharing to Discord forum channels requires a thread_name (251)

discourse-codebytes-plugin

Bug Fixes

  • Update decorator for core change (44)

discourse-data-explorer

Bug Fixes

  • Ensure dates passed in query params are parsed in the local timezone. (365)
  • Discourse automation reports with parameters (363)

discourse-livestream

UX Changes

  • Scope livestream styles to livestream topics (48)

discourse-lti

Bug Fixes

  • Add Content-Type header to explicit tell the browser to parse the resubmitted response as HTML (70)

discourse-microsoft-auth

New Features

  • Support Single Tenant for the Microsoft auth plugin (67)

discourse-reactions

UX Changes

  • Apply optional core border-radius to button (358)
  • Reactions user activity page shows names on mentions when site setting is true (355)

discourse-solved

New Features

  • Show ‘marked solved by’ in OP when topic is solved (343)

Bug Fixes

  • Migration was only done for first batch (344)

UX Changes

  • Better alignment and gaps for marked solved by (346)

discourse-tooltips

Bug Fixes

  • Align topic link with topic statuses (88)

discourse-translator

New Features

  • Better translation parsing via structured outputs (257)
  • Add hidden settings to limit automatic translation scope (255)
  • Allow untranslated posts in inline-translation mode to be manually translated (230)

Bug Fixes

  • Use is_a? instead of is_a for detecting class (260)
  • Split content for translation before sending (249)
  • Use specific prompts for topic titles (252)
  • Revert translating raw for translator providers as they strip newlines (250)
  • ‘Show original’ button only shows in topics where there are translated content (240)
  • Incorrect lang mapping using non-symbols (238)
  • Allow user to be deleted (236)
  • Do not let :globe_with_meridians: show up when the post is by a bot (228)
  • Absent scope in serializer will cause reports to fail (225)
  • Ensure translated content is safe for rendering (220)
  • Fancify titles when using experimental topic translation (224)
  • Do not return AI content if not in <output> (223)

UX Changes

  • Squarify the Show Original Content button in mobile (239)
  • Filter only content-translated languages for the language switcher (235)
  • Prevent users from wondering why backfilling is not happening (233)
  • Remove flash of :globe_with_meridians: when the post has yet to have its language determined (229)

discourse-user-notes

UX Changes

  • Update emoji, better icon match (122)

All Features and Fixes

Security Changes

  • Respect allow private messages prefernce for DMs
1 Like