# 3.4.5 Security fixes release
**URL:** https://meta.discourse.org/t/3-4-5-security-fixes-release/369347
**Category:** Announcements
**Tags:** release-notes
**Created:** [June 9, 2025, 3:57am UTC](https://meta.discourse.org/t/3-4-5-security-fixes-release/369347 "2025-06-09T03:57:43Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [June 9, 2025, 3:57am UTC](https://meta.discourse.org/t/3-4-5-security-fixes-release/369347/1 "2025-06-09T03:57:43Z")
## Security Updates
This release includes fixes for these security issues reported by our community and [HackerOne](https://hackerone.com/discourse).
- [Auto-executing third-party code in embedded CodePen iframe · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-cm93-6m2m-cjcv)
- [HTML injection when inviting to topic via email · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-x8mp-chx3-6x2p)
- [DoS via large URL payload in PM to a bot · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-3q5q-qmrm-rvwx)
---
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [June 9, 2025, 5:30am UTC](https://meta.discourse.org/t/3-4-5-security-fixes-release/369347/2 "2025-06-09T05:30:00Z")
### Even more!
But wait, there’s more! We do our best to highlight new features and changes for you, but there’s always too many changes to detail. For a full list of new features, bug fixes, UX improvements, and more, be sure to review the Additional Features and Fixes listed below.
## Plugin improvements
### discourse-activity-pub
#### New Features
- Allow everyone to see both followers and follows of Category and Tag Actors ([223](https://github.com/discourse/discourse-activity-pub/pull/223))
- Add actor deletion ([215](https://github.com/discourse/discourse-activity-pub/pull/215))
#### UX Changes
- Improve ActivityPub topic and post modals ([224](https://github.com/discourse/discourse-activity-pub/pull/224))
### discourse-ai
#### New Features
- Allow access to assigns from forum researcher ([1412](https://github.com/discourse/discourse-ai/pull/1412))
- Use different personas to power AI helper features.
- Add context and llm controls to researcher, fix username filter ([1401](https://github.com/discourse/discourse-ai/pull/1401))
- Add inferred concepts system ([1330](https://github.com/discourse/discourse-ai/pull/1330))
- Support upload.getUrl in custom tools ([1384](https://github.com/discourse/discourse-ai/pull/1384))
- Simplify streaming implementation - rush last update ([1380](https://github.com/discourse/discourse-ai/pull/1380))
- Automatic translation and localization of posts, topics, categories ([1376](https://github.com/discourse/discourse-ai/pull/1376))
#### Bug Fixes
- Update topic summarization prompt to work better when using full names ([1409](https://github.com/discourse/discourse-ai/pull/1409))
- When tool options are added they should be available ([1406](https://github.com/discourse/discourse-ai/pull/1406))
- Always render “today” on top of conversation sidebar ([1400](https://github.com/discourse/discourse-ai/pull/1400))
- Edit-topic is not invisible on desktop ([1394](https://github.com/discourse/discourse-ai/pull/1394))
- Unable to scroll on mobile AI post helper results ([1396](https://github.com/discourse/discourse-ai/pull/1396))
- Proper default LLM detection for inferred concepts ([1392](https://github.com/discourse/discourse-ai/pull/1392))
- Exporting overall sentiment fails ([1388](https://github.com/discourse/discourse-ai/pull/1388))
- Enum handling needs to be done on save as well ([1386](https://github.com/discourse/discourse-ai/pull/1386))
- Custom tools incorrectly setting all fields to blank enum ([1385](https://github.com/discourse/discourse-ai/pull/1385))
- Full page search broken ([1383](https://github.com/discourse/discourse-ai/pull/1383))
- Bump persona’s examples length ([1377](https://github.com/discourse/discourse-ai/pull/1377))
#### UX Changes
- Style tweaks for RAG uploader and form width ([1407](https://github.com/discourse/discourse-ai/pull/1407))
- AI composer helper refinements ([1387](https://github.com/discourse/discourse-ai/pull/1387))
#### Performance
- Optimize `.ai-debug-modal__tokens` selector ([1390](https://github.com/discourse/discourse-ai/pull/1390))
### discourse-calendar
#### New Features
- Show local timezone ([735](https://github.com/discourse/discourse-calendar/pull/735))
- Support for recurrence\_until ([730](https://github.com/discourse/discourse-calendar/pull/730))
- Optional attached chat channel for event ([728](https://github.com/discourse/discourse-calendar/pull/728))
#### Bug Fixes
- Nbsp handling in group-timezones ([739](https://github.com/discourse/discourse-calendar/pull/739))
- Prevents double event and uses correct starts\_at ([736](https://github.com/discourse/discourse-calendar/pull/736))
- Remove hard dependency on Chat plugin ([732](https://github.com/discourse/discourse-calendar/pull/732))
#### UX Changes
- Better copy ([737](https://github.com/discourse/discourse-calendar/pull/737))
### discourse-data-explorer
#### UX Changes
- Category-id-input: allows no-category selection ([377](https://github.com/discourse/discourse-data-explorer/pull/377))
### discourse-oauth2-basic
#### UX Changes
- Update admin settings plugin name ([130](https://github.com/discourse/discourse-oauth2-basic/pull/130))
### discourse-policy
#### Security Changes
- Policy group members ([165](https://github.com/discourse/discourse-policy/pull/165))
### discourse-saml
#### New Features
- Allow multiple attributes for group sync and also using group full\_name ([127](https://github.com/discourse/discourse-saml/pull/127))
## All Features and Fixes
### Security Changes
- Stricter default codepen on allowed\_iframes
- Respect max length in bot-human PMs (stable)
- Escape topic title for mailers (stable)