v0.159.10
Infisical/infisicalv0.159.10Apr 14, 2026by victorvhs017
AI Summary
A major update focusing on performance optimizations, security hardening against SSRF, and expanding PAM capabilities with AI insights and new SSH certificate management features.
Key Highlights
- Hardened webhooks against SSRF (CWE-918)
- AI session insights for PAM
- Performance optimizations via request-scoped memoization
- Node.js 22 upgrade
- SSH CA JSON API
New Features
- AI session insights
- SSH CA JSON API
- Request-scoped memoization
- withCache helper
- Node.js 22 upgrade
- Hardened webhooks
Full Release Notes
## What's Changed * chore: rename password generator validation rule label by @varonix0 in https://github.com/Infisical/infisical/pull/5967 * improvement(audit-logs): audit logs performance warning by @victorvhs017 in https://github.com/Infisical/infisical/pull/5876 * fix: vercel secret sync pagination by @varonix0 in https://github.com/Infisical/infisical/pull/5972 * improvement(sync-secrets): add icon to show the sync status on secrets by @adilsitos in https://github.com/Infisical/infisical/pull/5959 * fix(notifications): add break words and overflow to avoid horizontal scroll by @adilsitos in https://github.com/Infisical/infisical/pull/5974 * fix(docs): use correct PostHog project API key for docs analytics by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5975 * feat(pam): real-time session log sync via incremental batch uploads by @bernie-g in https://github.com/Infisical/infisical/pull/5965 * chore: improve docs for SMTP local development by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5988 * improvement(dynamic-secrets): add JSON API for SSH CA public key by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/5979 * fix: remove SMTP variables from environment for BDD tests by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5994 * fix: proper subject check by @x032205 in https://github.com/Infisical/infisical/pull/5991 * fix(machine-identity): revamp number of times a token can be used by @adilsitos in https://github.com/Infisical/infisical/pull/5978 * chore: move node version from 20 to 22 by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5983 * feat(pam): add SQL runner in data explorer by @bernie-g in https://github.com/Infisical/infisical/pull/5954 * chore: add JAMF PKI configuration doc by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5998 * feature(cache): add withCache helper and refactor Redis cache-aside usage by @victorvhs017 in https://github.com/Infisical/infisical/pull/5987 * fix(additional-privileges): validate omitted permissions on user project additional privilege update by @victorvhs017 in https://github.com/Infisical/infisical/pull/5995 * feat: add PKI SCEP e2e tests by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5851 * fix: restrict admin config response and harden webhook/integration validation by @x032205 in https://github.com/Infisical/infisical/pull/6004 * feature(request-context): implement request-scoped memoization for optimized DB reads by @victorvhs017 in https://github.com/Infisical/infisical/pull/5990 * feature(pam): ai session insights by @bernie-g in https://github.com/Infisical/infisical/pull/5989 * docs(pam): add view credentials documentation by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/6009 * fix: redirect oauth callback by @x032205 in https://github.com/Infisical/infisical/pull/6013 * feat: add infisical version on side menu for dedicated and on-prem by @mathnogueira in https://github.com/Infisical/infisical/pull/6012 * fix: validate all permission rules in access approval requests by @x032205 in https://github.com/Infisical/infisical/pull/6019 * fix(identity): enforce delete protection in scoped identity delete by @syedmazharaliraza in https://github.com/Infisical/infisical/pull/6014 * fix(app-connection): rollback SSH connection algorithms by @victorvhs017 in https://github.com/Infisical/infisical/pull/6022 * fix: remove "Grant Privileges (legacy)" from policy template by @mathnogueira in https://github.com/Infisical/infisical/pull/6016 ## Security * Hardened webhook delivery against a server-side request forgery issue (CWE-918): outbound webhook requests no longer follow HTTP redirects past URL validation, so a validated destination cannot be redirected to an internal address. Thanks to Drew Morana for reporting this through responsible disclosure. See https://github.com/Infisical/infisical/pull/6004 ## New Contributors * @mathnogueira made their first contribution in https://github.com/Infisical/infisical/pull/6012 **Full Changelog**: https://github.com/Infisical/infisical/compare/v0.43.70...v0.159.10