v1.53.0 1.23.1
HumanSignal/label-studioSep 8, 2026 → Sep 25, 202617 days between releases
What's New
Requires PostgreSQL 14+, blocks private network requests, and disables debug exceptions by default.
Breaking Changes
- PostgreSQL 14 or higher is now required.
- SSRF protection defaults to blocking private or local networks.
- ML backends on localhost are blocked by default.
- Debug exceptions are disabled by default in the UI.
New Features
- New secure default configuration for SSRF protection.
- New secure default configuration for ML backend blocking.
- Improved HTML sanitization in the labeling interface.
- Enhanced permission checks for storage and ML backend management.
Improvements
- Stronger SSRF protection for ML backends, webhooks, cloud storage, and URL imports.
- Tighter permission checks when creating storages, webhooks, and ML backends.
- Fixed access checks for local file storage and Data Manager filters.
- Improved HTML sanitization in the labeling interface.
Bug Fixes
- Fixed access checks for local file storage and Data Manager filters.
Upgrade Notes
You must upgrade to PostgreSQL 14 or higher as Django 5.2 is now required. New secure defaults block private network requests and localhost ML backends; set SSRF_PROTECTION_ENABLED=false or ML_BLOCK_LOCAL_IP=false if your infrastructure relies on these.
The Two Releases
v1.53.0
Sep 8, 2026· 1 month ago
This release focuses on infrastructure improvements and development environment stability, including dependency updates and switching from MailHog to Mailpit for SMTP testing.
Full release notes1.23.1
Sep 25, 2026· 27 days ago
This security-focused patch release introduces stricter protections for ML backends and webhooks while requiring PostgreSQL 14 or higher. It also enforces new secure default configurations for network access and error handling.
Full release notes