v0.159.10

Infisical/infisicalv0.159.10Apr 14, 2026by victorvhs017

AI Summary

A major update focusing on performance optimizations, security hardening against SSRF, and expanding PAM capabilities with AI insights and new SSH certificate management features.

Key Highlights

  • Hardened webhooks against SSRF (CWE-918)
  • AI session insights for PAM
  • Performance optimizations via request-scoped memoization
  • Node.js 22 upgrade
  • SSH CA JSON API

New Features

  • AI session insights
  • SSH CA JSON API
  • Request-scoped memoization
  • withCache helper
  • Node.js 22 upgrade
  • Hardened webhooks

Full Release Notes

## What's Changed
* chore: rename password generator validation rule label by @varonix0 in https://github.com/Infisical/infisical/pull/5967
* improvement(audit-logs): audit logs performance warning by @victorvhs017 in https://github.com/Infisical/infisical/pull/5876
* fix: vercel secret sync pagination by @varonix0 in https://github.com/Infisical/infisical/pull/5972
* improvement(sync-secrets): add icon to show the sync status on secrets by @adilsitos in https://github.com/Infisical/infisical/pull/5959
* fix(notifications): add break words and overflow to avoid horizontal scroll by @adilsitos in https://github.com/Infisical/infisical/pull/5974
* fix(docs): use correct PostHog project API key for docs analytics by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5975
* feat(pam): real-time session log sync via incremental batch uploads by @bernie-g in https://github.com/Infisical/infisical/pull/5965
* chore: improve docs for SMTP local development by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5988
* improvement(dynamic-secrets): add JSON API for SSH CA public key by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/5979
* fix: remove SMTP variables from environment for BDD tests by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5994
* fix: proper subject check by @x032205 in https://github.com/Infisical/infisical/pull/5991
* fix(machine-identity): revamp number of times a token can be used by @adilsitos in https://github.com/Infisical/infisical/pull/5978
* chore: move node version from 20 to 22 by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5983
* feat(pam): add SQL runner in data explorer by @bernie-g in https://github.com/Infisical/infisical/pull/5954
* chore: add JAMF PKI configuration doc by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5998
* feature(cache): add withCache helper and refactor Redis cache-aside usage by @victorvhs017 in https://github.com/Infisical/infisical/pull/5987
* fix(additional-privileges): validate omitted permissions on user project additional privilege update by @victorvhs017 in https://github.com/Infisical/infisical/pull/5995
* feat: add PKI SCEP e2e tests by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5851
* fix: restrict admin config response and harden webhook/integration validation by @x032205 in https://github.com/Infisical/infisical/pull/6004
* feature(request-context): implement request-scoped memoization for optimized DB reads by @victorvhs017 in https://github.com/Infisical/infisical/pull/5990
* feature(pam): ai session insights  by @bernie-g in https://github.com/Infisical/infisical/pull/5989
* docs(pam): add view credentials documentation by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/6009
* fix: redirect oauth callback by @x032205 in https://github.com/Infisical/infisical/pull/6013
* feat: add infisical version on side menu for dedicated and on-prem by @mathnogueira in https://github.com/Infisical/infisical/pull/6012
* fix: validate all permission rules in access approval requests by @x032205 in https://github.com/Infisical/infisical/pull/6019
* fix(identity): enforce delete protection in scoped identity delete by @syedmazharaliraza in https://github.com/Infisical/infisical/pull/6014
* fix(app-connection): rollback SSH connection algorithms by @victorvhs017 in https://github.com/Infisical/infisical/pull/6022
* fix: remove "Grant Privileges (legacy)" from policy template by @mathnogueira in https://github.com/Infisical/infisical/pull/6016

## Security
* Hardened webhook delivery against a server-side request forgery issue (CWE-918): outbound webhook requests no longer follow HTTP redirects past URL validation, so a validated destination cannot be redirected to an internal address. Thanks to Drew Morana for reporting this through responsible disclosure. See https://github.com/Infisical/infisical/pull/6004

## New Contributors
* @mathnogueira made their first contribution in https://github.com/Infisical/infisical/pull/6012

**Full Changelog**: https://github.com/Infisical/infisical/compare/v0.43.70...v0.159.10