1.9.2

HumanSignal/label-studio1.9.2Nov 7, 2023by github-actions[bot]

AI Summary

Focuses on security hardening with XSS and SSRF fixes, while introducing new configuration options for SSL verification and SQLite hosting.

Key Highlights

  • Fix for XSS vulnerabilities (CVE-2023-47115)
  • Fix for SSRF DNS rebinding issue
  • New `VERIFY_SSL_CERTS` environment variable (defaults to true)
  • New `WINDOWS_SQLITE_BINARY_HOST_PREFIX` environment variable

Breaking Changes

  • The `VERIFY_SSL_CERTS` setting now defaults to true, which may block loading data from HTTPS URLs with unverified certificates.

New Features

  • XSS fixes
  • SSRF fix
  • SSL verification configuration
  • SQLite binary hosting support
  • AWS Signature Version 4 query parameters support

Full Release Notes

## What's New 

### Enhancements

- Added a new legacy parameter to the Taxonomy tag. This will allow users to continue to access the legacy version of Taxonomy after upcoming feature work is completed. ([#4884](https://github.com/HumanSignal/label-studio/pull/4884))
- Added support for AWS Signature Version 4 query parameters. Special thanks to community member @darthhexx  for their contribution. ([#4928](https://github.com/HumanSignal/label-studio/pull/4928))

### Breaking Changes

- This release adds a deployment-wide VERIFY_SSL_CERTS setting that defaults to true. Customers who are loading data (e.g. uploading tasks) from https URLs without verifiable SSL certificates must set VERIFY_SSL_CERTS to false in their environment variables before deploying Label Studio 1.9.2+. ([#4862](https://github.com/HumanSignal/label-studio/pull/4862))
- Add WINDOWS_SQLITE_BINARY_HOST_PREFIX environment variable to support hosting SQLite binaries on a server other than [sqlite.org](http://sqlite.org/), for Windows deployments running Python 3.8 only. ([#4862](https://github.com/HumanSignal/label-studio/pull/4862))
    

### Security

- Fixed an XSS vulnerability with certain error pages. ([#4926](https://github.com/HumanSignal/label-studio/pull/4926))
- Fixed an XSS vulnerability related to file extensions for avatars. This change addresses [`CVE-2023-47115`](https://github.com/HumanSignal/label-studio/security/advisories/GHSA-q68h-xwq5-mm7x). ([#4818](https://github.com/HumanSignal/label-studio/pull/4818))
- Fixed an SSRF DNS rebinding issue. ([#4828](https://github.com/HumanSignal/label-studio/pull/4828))


### Bug Fixes

- Fixed an issue where users would see a run time error seen when creating or syncing Azure blob storage. ([#4905](https://github.com/HumanSignal/label-studio/pull/4905))
- Fixed an issue where tasks created through source storage were not triggering webhooks. ([#4845](https://github.com/HumanSignal/label-studio/pull/4845))

## Contributors

### New Contributors

- @darthhexx made their first contribution in [PR #4928](https://github.com/HumanSignal/label-studio/pull/4928)

### Contributors

- @juliosgarbi 
- @bmartel 
- @jombooth 
- @triklozoid 


> Full Changelog: [tags/1.9.1.post0...1.9.2](https://github.com/HumanSignal/label-studio/compare/tags/1.9.1.post0...de252f58c9f3ef76e907a5f181c49948a6b0362f.diff)
> This changelog was updated in response to a push of de252f58c9f3ef76e907a5f181c49948a6b0362f [Workflow run](https://github.com/HumanSignal/label-studio/actions/runs/6631172317)
> 
> Jira Release not found
> [Aha! Release 1.9.2](https://labelstudio.aha.io/api/v1/features?tag=LS%201.9.2)
> Release Notes are generated based on git log: No tasks found in Task Tracker.
> <details>
> <summary>Turned off Feature Flags (93)</summary>
> 
> - [feat_all_optic_71_dashboard_multiple_labeling_group_support_v1_01092023_short](https://app.launchdarkly.com/default/community/features/feat_all_optic_71_dashboard_multiple_labeling_group_support_v1_01092023_short/targeting)
> - [feat_front_dev_1752_notification_links_in_label_and_review_streams](https://app.launchdarkly.com/default/community/features/feat_front_dev_1752_notification_links_in_label_and_review_streams/targeting)
> - [feat_front_dev_3260_alternative_shortcuts_for_video_naviagtion](https://app.launchdarkly.com/default/community/features/feat_front_dev_3260_alternative_shortcuts_for_video_naviagtion/targeting)
> - [feat_front_dev_399_lock_interface_when_trial_expired_short](https://app.launchdarkly.com/default/community/features/feat_front_dev_399_lock_interface_when_trial_expired_short/targeting)
> - [feat_front_dev_4008_quick_task_open_short](https://app.launchdarkly.com/default/community/features/feat_front_dev_4008_quick_task_open_short/targeting)
> - [feat_front_lsdv_4583_multi_image_segmentation_short](https://app.launchdarkly.com/default/community/features/feat_front_lsdv_4583_multi_image_segmentation_short/targeting)
> - [ff_back_1587_email_notifications_310122_long](https://app.launchdarkly.com/default/community/features/ff_back_1587_email_notifications_310122_long/targeting)
> - [ff_back_2004_async_review_24032022_short](https://app.launchdarkly.com/default/community/features/ff_back_2004_async_review_24032022_short/targeting)
> - [ff_back_2884_comments_notifications_02092022_short](https://app.launchdarkly.com/default/community/features/ff_back_2884_comments_notifications_02092022_short/targeting)
> - [ff_back_DEV_1711_review_queue_140222_short](https://app.launchdarkly.com/default/community/features/ff_back_DEV_1711_review_queue_140222_short/targeting)
> - [ff_back_DEV_3374_review_query_160922_short](https://app.launchdarkly.com/default/community/features/ff_back_DEV_3374_review_query_160922_short/targeting)
> - [ff_back_dev_1417_start_training_mlbackend_webhooks_250122_long](https://app.launchdarkly.com/default/community/features/ff_back_dev_1417_start_training_mlbackend_webhooks_250122_long/targeting)
> - [ff_back_dev_1948_reviewed_status_16052022_short](https://app.launchdarkly.com/default/community/features/ff_back_dev_1948_reviewed_status_16052022_short/targeting)
> - [ff_back_dev_2362_project_credentials_060722_short](https://app.launchdarkly.com/default/community/features/ff_back_dev_2362_project_credentials_060722_short/targeting)
> - [ff_back_dev_4664_remove_storage_file_on_export_delete_29032023_short](https://app.launchdarkly.com/default/community/features/ff_back_dev_4664_remove_storage_file_on_export_delete_29032023_short/targeting)
> - [ff_back_experimental_features](https://app.launchdarkly.com/default/community/features/ff_back_experimental_features/targeting)
> - [ff_front_DEV_1713_audio_ui_150222_short](https://app.launchdarkly.com/default/community/features/ff_front_DEV_1713_audio_ui_150222_short/targeting)
> - [ff_front_dev_1442_unselect_shape_on_click_outside_080622_short](https://app.launchdarkly.com/default/community/features/ff_front_dev_1442_unselect_shape_on_click_outside_080622_short/targeting)
> - [ff_front_dev_1470_dm_pagination_010422_short](https://app.launchdarkly.com/default/community/features/ff_front_dev_1470_dm_pagination_010422_short/targeting)
> - [ff_front_dev_1480_created_on_in_review_180122_short](https://app.launchdarkly.com/default/community/features/ff_front_dev_1480_created_on_in_review_180122_short/targeting)
> - [ff_front_dev_1555_auto_annotations_not_visible](https://app.launchdarkly.com/default/community/features/ff_front_dev_1555_auto_annotations_not_visible/targeting)
> - [ff_front_dev_1658_notification_center_170222_short](https://app.launchdarkly.com/default/community/features/ff_front_dev_1658_notification_center_170222_short/targeting)
> - [ff_front_dev_2186_comments_for_update](https://app.launchdarkly.com/default/community/features/ff_front_dev_2186_comments_for_update/targeting)
> - [ff_front_dev_2458_comments_for_skip_250522_short](https://app.launchdarkly.com/default/community/features/ff_front_dev_2458_comments_for_skip_250522_short/targeting)
> - [ff_front_dev_2671_anchor_rotate_bbox_010722_short](https://app.launchdarkly.com/default/community/features/ff_front_dev_2671_anchor_rotate_bbox_010722_short/targeting)
> - [fflag-feat-back-lops-154-datasets-export-candidates](https://app.launchdarkly.com/default/community/features/fflag-feat-back-lops-154-datasets-export-candidates/targeting)
> - [fflag-feat-dev-2887-comments-ui-editor-short](https://app.launchdarkly.com/default/community/features/fflag-feat-dev-2887-comments-ui-editor-short/targeting)
> - [fflag-feat-dev-3034-comments-with-drafts-short](https://app.launchdarkly.com/default/community/features/fflag-feat-dev-3034-comments-with-drafts-short/targeting)
> - [fflag-feat-dia-407-accept-multiple-search-queries-short](https://app.launchdarkly.com/default/community/features/fflag-feat-dia-407-accept-multiple-search-queries-short/targeting)
> - [fflag-feat-front-dev-2395-consistent-working-area-for-all-image-sizes](https://app.launchdarkly.com/default/community/features/fflag-feat-front-dev-2395-consistent-working-area-for-all-image-sizes/targeting)
> - [fflag-feat-front-dev-2866-free-trial-invite-short](https://app.launchdarkly.com/default/community/features/fflag-feat-front-dev-2866-free-trial-invite-short/targeting)
> - [fflag-feat-front-dev-3051-trial-experience](https://app.launchdarkly.com/default/community/features/fflag-feat-front-dev-3051-trial-experience/targeting)
> - [fflag_feat_all_dia_13_structured_data_support_short](https://app.launchdarkly.com/default/community/features/fflag_feat_all_dia_13_structured_data_support_short/targeting)
> - [fflag_feat_all_lops_315_temp_datasets_limitations_short](https://app.launchdarkly.com/default/community/features/fflag_feat_all_lops_315_temp_datasets_limitations_short/targeting)
> - [fflag_feat_all_lops_milvus_migration_short](https://app.launchdarkly.com/default/community/features/fflag_feat_all_lops_milvus_migration_short/targeting)
> - [fflag_feat_all_lsdv_4915_async_task_import_13042023_short](https://app.launchdarkly.com/default/community/features/fflag_feat_all_lsdv_4915_async_task_import_13042023_short/targeting)
> - [fflag_feat_all_lsdv_4945_api_requests_with_pagination_20042023_short](https://app.launchdarkly.com/default/community/features/fflag_feat_all_lsdv_4945_api_requests_with_pagination_20042023_short/targeting)
> - [fflag_feat_all_lsdv_e_295_project_level_roles_via_saml_scim_ldap_short](https://app.launchdarkly.com/default/community/features/fflag_feat_all_lsdv_e_295_project_level_roles_via_saml_scim_ldap_short/targeting)
> - [fflag_feat_all_optic_114_soft_delete_for_churned_employees](https://app.launchdarkly.com/default/community/features/fflag_feat_all_optic_114_soft_delete_for_churned_employees/targeting)
> - [fflag_feat_back_dev_3756_queue_enrollment_min_short](https://app.launchdarkly.com/default/community/features/fflag_feat_back_dev_3756_queue_enrollment_min_short/targeting)
> - [fflag_feat_back_dev_3792_add_sync_update_is_labeled_301122_short](https://app.launchdarkly.com/default/community/features/fflag_feat_back_dev_3792_add_sync_update_is_labeled_301122_short/targeting)
> - [fflag_feat_back_dev_3792_next_task_data_fix_long](https://app.launchdarkly.com/default/community/features/fflag_feat_back_dev_3792_next_task_data_fix_long/targeting)
> - [fflag_feat_back_lsdv_3958_server_side_encryption_for_target_storage_short](https://app.launchdarkly.com/default/community/features/fflag_feat_back_lsdv_3958_server_side_encryption_for_target_storage_short/targeting)
> - [fflag_feat_back_lsdv_4932_enable_memory_profiler](https://app.launchdarkly.com/default/community/features/fflag_feat_back_lsdv_4932_enable_memory_profiler/targeting)
> - [fflag_feat_back_lsdv_5307_import_reviews_drafts_29062023_short](https://app.launchdarkly.com/default/community/features/fflag_feat_back_lsdv_5307_import_reviews_drafts_29062023_short/targeting)
> - [fflag_feat_dev_2755_regions_list_grouped_by_labels_with_ordered_collapse_short](https://app.launchdarkly.com/default/community/features/fflag_feat_dev_2755_regions_list_grouped_by_labels_with_ordered_collapse_short/targeting)
> - [fflag_feat_front_dev-2536_comment_notifications_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_dev-2536_comment_notifications_short/targeting)
> - [fflag_feat_front_dev_2758_adjustable_draggable_spans_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_dev_2758_adjustable_draggable_spans_short/targeting)
> - [fflag_feat_front_dev_3051_trial_experience_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_dev_3051_trial_experience_short/targeting)
> - [fflag_feat_front_dev_3143_explore_page_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_dev_3143_explore_page_short/targeting)
> - [fflag_feat_front_leap_e_1_monorepo_migration_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_leap_e_1_monorepo_migration_short/targeting)
> - [fflag_feat_front_leap_e_4_streams_refinements_long](https://app.launchdarkly.com/default/community/features/fflag_feat_front_leap_e_4_streams_refinements_long/targeting)
> - [fflag_feat_front_lops_12_label_ops_ui_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lops_12_label_ops_ui_short/targeting)
> - [fflag_feat_front_lops_75_pretty_select_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lops_75_pretty_select_short/targeting)
> - [fflag_feat_front_lops_86_datasets_storage_edit_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lops_86_datasets_storage_edit_short/targeting)
> - [fflag_feat_front_lops_e_10_updated_ux_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lops_e_10_updated_ux_short/targeting)
> - [fflag_feat_front_lsdv_3025_outliner_filter_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lsdv_3025_outliner_filter_short/targeting)
> - [fflag_feat_front_lsdv_4583_6_images_preloading_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lsdv_4583_6_images_preloading_short/targeting)
> - [fflag_feat_front_lsdv_4583_multi_image_segmentation_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lsdv_4583_multi_image_segmentation_short/targeting)
> - [fflag_feat_front_lsdv_5451_async_taxonomy_110823_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lsdv_5451_async_taxonomy_110823_short/targeting)
> - [fflag_feat_front_lsdv_5452_taxonomy_labeling_110823_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_lsdv_5452_taxonomy_labeling_110823_short/targeting)
> - [fflag_feat_front_prod_281_project_list_search_19072023_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_prod_281_project_list_search_19072023_short/targeting)
> - [fflag_feat_front_prod_292_archive_workspaces_short](https://app.launchdarkly.com/default/community/features/fflag_feat_front_prod_292_archive_workspaces_short/targeting)
> - [fflag_feat_optic_67_drag_and_drop_charts](https://app.launchdarkly.com/default/community/features/fflag_feat_optic_67_drag_and_drop_charts/targeting)
> - [fflag_fix_all_lsdv_4813_async_export_conversion_22032023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_all_lsdv_4813_async_export_conversion_22032023_short/targeting)
> - [fflag_fix_all_lsdv_4896_dm_actions_to_reviewers_20230403_short](https://app.launchdarkly.com/default/community/features/fflag_fix_all_lsdv_4896_dm_actions_to_reviewers_20230403_short/targeting)
> - [fflag_fix_all_lsdv_4971_async_reimport_09052023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_all_lsdv_4971_async_reimport_09052023_short/targeting)
> - [fflag_fix_all_optic_18_dashboard_label_distribution_chart_async_22082023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_all_optic_18_dashboard_label_distribution_chart_async_22082023_short/targeting)
> - [fflag_fix_all_optic_79_task_count_is_wrong_short](https://app.launchdarkly.com/default/community/features/fflag_fix_all_optic_79_task_count_is_wrong_short/targeting)
> - [fflag_fix_back_dev_3668_review_stream_optimizaion_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_dev_3668_review_stream_optimizaion_short/targeting)
> - [fflag_fix_back_dev_4174_overlap_issue_experiments_10012023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_dev_4174_overlap_issue_experiments_10012023_short/targeting)
> - [fflag_fix_back_dev_4185_next_task_additional_logging_long](https://app.launchdarkly.com/default/community/features/fflag_fix_back_dev_4185_next_task_additional_logging_long/targeting)
> - [fflag_fix_back_leap_24_tasks_api_optimization_05092023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_leap_24_tasks_api_optimization_05092023_short/targeting)
> - [fflag_fix_back_lsdv_1044_check_annotations_24012023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_1044_check_annotations_24012023_short/targeting)
> - [fflag_fix_back_lsdv_3029_set_password_on_trial_signup_25012023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_3029_set_password_on_trial_signup_25012023_short/targeting)
> - [fflag_fix_back_lsdv_4523_show_overlap_first_order_27022023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_4523_show_overlap_first_order_27022023_short/targeting)
> - [fflag_fix_back_lsdv_4826_annotation_history_20230331_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_4826_annotation_history_20230331_short/targeting)
> - [fflag_fix_back_lsdv_5289_prevent_db_deadlocks_16062023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_5289_prevent_db_deadlocks_16062023_short/targeting)
> - [fflag_fix_back_lsdv_5289_run_bulk_updates_in_transactions_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_5289_run_bulk_updates_in_transactions_short/targeting)
> - [fflag_fix_back_lsdv_5361_members_dashboard_page_timeouts](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_5361_members_dashboard_page_timeouts/targeting)
> - [fflag_fix_back_lsdv_5410_temporary_disable_auto_inference_jobs_short](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_5410_temporary_disable_auto_inference_jobs_short/targeting)
> - [fflag_fix_back_lsdv_5425_1_enable_permissions_restrictions_for_annotators_long](https://app.launchdarkly.com/default/community/features/fflag_fix_back_lsdv_5425_1_enable_permissions_restrictions_for_annotators_long/targeting)
> - [fflag_fix_font_lsdv_3009_draft_saving_stuck_130223_short](https://app.launchdarkly.com/default/community/features/fflag_fix_font_lsdv_3009_draft_saving_stuck_130223_short/targeting)
> - [fflag_fix_front_dev_2918_labeling_filtered_paragraphs_250822_short](https://app.launchdarkly.com/default/community/features/fflag_fix_front_dev_2918_labeling_filtered_paragraphs_250822_short/targeting)
> - [fflag_fix_front_dev_3391_interactive_view_all](https://app.launchdarkly.com/default/community/features/fflag_fix_front_dev_3391_interactive_view_all/targeting)
> - [fflag_fix_front_dev_3706_undo_with_ml_backend_081122_short](https://app.launchdarkly.com/default/community/features/fflag_fix_front_dev_3706_undo_with_ml_backend_081122_short/targeting)
> - [fflag_fix_front_dev_3734_hide_task_counter_131222_short](https://app.launchdarkly.com/default/community/features/fflag_fix_front_dev_3734_hide_task_counter_131222_short/targeting)
> - [fflag_fix_front_lsdv_5177_image_regions_in_history_260523_short](https://app.launchdarkly.com/default/community/features/fflag_fix_front_lsdv_5177_image_regions_in_history_260523_short/targeting)
> - [fflag_fix_front_lsdv_5177_save_draft_on_task_switch_250523_short](https://app.launchdarkly.com/default/community/features/fflag_fix_front_lsdv_5177_save_draft_on_task_switch_250523_short/targeting)
> - [fflag_fix_front_lsdv_5436_dashboard_members_page_async_24072023_short](https://app.launchdarkly.com/default/community/features/fflag_fix_front_lsdv_5436_dashboard_members_page_async_24072023_short/targeting)
> - [fix-backend-dev-3134-exclude-deactivated-users](https://app.launchdarkly.com/default/community/features/fix-backend-dev-3134-exclude-deactivated-users/targeting)
> - [fix_back_dev_3351_ml_validation_error_extension_short](https://app.launchdarkly.com/default/community/features/fix_back_dev_3351_ml_validation_error_extension_short/targeting)
> - [fix_backend_dev_3134_exclude_deactivated_users](https://app.launchdarkly.com/default/community/features/fix_backend_dev_3134_exclude_deactivated_users/targeting)
> 
> </details>
> 
> **ALL LINES STARTING FROM QUOTE WILL BE IGNORED**