Starstruk Logo MarkStarstruk

v6.2.2

grokability/snipe-itv6.2.2Oct 6, 2023by snipe

AI Summary

A security release fixing an XSS vulnerability in the 'Changed' column of asset history and upgrading css-loader.

Key Highlights

  • Fixed XSS vulnerability in asset history 'Changed' column.
  • Speed up EOL Migration.
  • Added check-in button on components tab.
  • Upgraded css-loader to 5.0.0.

Full Release Notes

## ⚠️ IMPORTANT: Future versions of Snipe-IT will require PHP 8.1 or greater

This is largely a bug fix and a security release, with an XSS bug reported shahzaibak96 on Huntr.Dev that would allow potential XSS attacks to be executed in the "Changed" column as the names of things that were old/new were not being properly escaped. We encourage folks to upgrade. 

## What's Changed
* Standardize Asset EOL Date by @spencerrlongg in https://github.com/snipe/snipe-it/pull/13585
* Logs non-compliant barcode error as debug message by @marcusmoore in https://github.com/snipe/snipe-it/pull/13694
* Log non-compliant barcode error as debug message by @marcusmoore in https://github.com/snipe/snipe-it/pull/13695
* Fixed potential call to a member function toArray() on null by @marcusmoore in https://github.com/snipe/snipe-it/pull/13696
* [Snyk] Security upgrade css-loader from 4.3.0 to 5.0.0 #13685 by @snipe in https://github.com/snipe/snipe-it/pull/13713
* Speed up EOL Migration by @spencerrlongg in https://github.com/snipe/snipe-it/pull/13709
* added proper margin-top to sidebar menu on bigger resolutions by @Godmartinz in https://github.com/snipe/snipe-it/pull/13693
* Added a check-in button on components tab of Asset view by @Godmartinz in https://github.com/snipe/snipe-it/pull/13704
* Fixed missing escaping asset history old/new values by @snipe in https://github.com/snipe/snipe-it/pull/13720


**Full Changelog**: https://github.com/snipe/snipe-it/compare/v6.2.1...v6.2.2