v6.3.1
grokability/snipe-itv6.3.1Feb 15, 2024by snipe
AI Summary
A security and bug fix release addressing API checkout issues, XSS vulnerabilities, and upgrading several libraries to patch CVEs.
Key Highlights
- Added Google Chat notifications support.
- Fixed XSS vulnerability in file uploads.
- Fixed accessory/consumable checkout via API.
- Upgraded composer and symfony packages for security.
New Features
- Google Chat notifications
- Security upgrades for Composer, Symfony, and OAuth2
Full Release Notes
## ⚠️ IMPORTANT: Future versions of Snipe-IT will require PHP 8.1 or greater ## What's Changed * Fixed accessory checkout via API not sending notification and not adhering to qty limit by @marcusmoore in https://github.com/snipe/snipe-it/pull/14181 * Removed initial check for assets, licenses, etc by @snipe in https://github.com/snipe/snipe-it/pull/14215 * Fixed company asset counts for dashboard widget by @snipe in https://github.com/snipe/snipe-it/pull/14216 * Fixed FD-40296 - mobile uploads sometimes uploading with incorrect orientation by @snipe in https://github.com/snipe/snipe-it/pull/14213 * Upgrade bootstrap-table from 1.22.1 to 1.22.2 #14199 by @snipe in https://github.com/snipe/snipe-it/pull/14217 * Added support for Google Chat notifications by @Godmartinz in https://github.com/snipe/snipe-it/pull/14191 * Security upgrade alpine from 3.18.5 to 3.18.6 #14178 by @snipe in https://github.com/snipe/snipe-it/pull/14218 * Fixed consumable checkout via API not sending notification by @marcusmoore in https://github.com/snipe/snipe-it/pull/14190 * Use parseEscapedMarkedownInline for more views by @gitgrimbo in https://github.com/snipe/snipe-it/pull/13805 * Fixed #14185 - Resurfaced `load_remote` in admin by @snipe in https://github.com/snipe/snipe-it/pull/14219 * Removed loading of assets for label count by @snipe in https://github.com/snipe/snipe-it/pull/14220 * Chunk data to reduce memory on large datasets when updating `next_audit_date` by @snipe in https://github.com/snipe/snipe-it/pull/14221 * Added tests around getIdForCurrentUser method by @marcusmoore in https://github.com/snipe/snipe-it/pull/14222 * Switch to bulk updating to handle audit interval updates by @snipe in https://github.com/snipe/snipe-it/pull/14227 * Fixed Select2 functionality in User bulk check-in Delete User by @Godmartinz in https://github.com/snipe/snipe-it/pull/14223 * Fixed: 404 Error on Importer When Uploading a .csv Under Certain Circumstance by @akemidx in https://github.com/snipe/snipe-it/pull/14228 * Fixes file upload XSS vulnerability [sc-24156] by @uberbrady in https://github.com/snipe/snipe-it/pull/14233 * Fixed the general webhook not notifying anymore by @Godmartinz in https://github.com/snipe/snipe-it/pull/14187 * Fixed select inputs un-select2-ifying on mobile by @Godmartinz in https://github.com/snipe/snipe-it/pull/14229 * Fixed barcodes crashing if asset was deleted by @snipe in https://github.com/snipe/snipe-it/pull/14240 * Revert "Fixed barcodes crashing if asset was deleted" by @snipe in https://github.com/snipe/snipe-it/pull/14241 * Fixed ReportsController to not try to return a serial if the item doesn’t exist by @snipe in https://github.com/snipe/snipe-it/pull/14243 * Return null if asset was hard-deleted/purged by @snipe in https://github.com/snipe/snipe-it/pull/14244 * Fixes Default Location Being Set During Asset Creation and Checkout by @spencerrlongg in https://github.com/snipe/snipe-it/pull/14188 * Bump codacy/codacy-analysis-cli-action from 4.3.0 to 4.4.0 by @dependabot in https://github.com/snipe/snipe-it/pull/14251 * Fixed accessory check in emails being sent when setting disabled by @marcusmoore in https://github.com/snipe/snipe-it/pull/14256 * Cleaned up navbar-custom-menu by @mauro-miatello in https://github.com/snipe/snipe-it/pull/14250 * Change how we check forward-looking upgrade requirements by @jerm in https://github.com/snipe/snipe-it/pull/14236 * Fixes CVE-2024-24821 by upgrading composer/composer by @joelpittet in https://github.com/snipe/snipe-it/pull/14245 * Fixes CVE-2022-24894 by upgrading symfony/http-kernel by @joelpittet in https://github.com/snipe/snipe-it/pull/14246 * Fixes CVE-2023-37260 upgrading league/oauth2-server by @joelpittet in https://github.com/snipe/snipe-it/pull/14247 * Added LDAP group tag to LDAP tests by @marcusmoore in https://github.com/snipe/snipe-it/pull/14255 * Fixed incorrect string for location not existing by @snipe in https://github.com/snipe/snipe-it/pull/14261 * Added serial and status label to asset maintenances page and API by @snipe in https://github.com/snipe/snipe-it/pull/14264 * Updated testing helper name by @marcusmoore in https://github.com/snipe/snipe-it/pull/14272 * Upgrade alpinejs from 3.13.3 to 3.13.5 by @snipe in https://github.com/snipe/snipe-it/pull/14274 * Upgrade webpack from 5.89.0 to 5.90.0 by @snipe in https://github.com/snipe/snipe-it/pull/14275 * Fixed the notification listener by @Godmartinz in https://github.com/snipe/snipe-it/pull/14268 * Fixed ambiguous query on supplier_id in maintenances by @snipe in https://github.com/snipe/snipe-it/pull/14276 * Resolve Duplicate Activity Logs for Imports by @spencerrlongg in https://github.com/snipe/snipe-it/pull/14172 * Fixes #14010 Adds Components and Licenses logs to Assets history view by @inietov in https://github.com/snipe/snipe-it/pull/14197 * Lower log level to warning on webhook failure by @snipe in https://github.com/snipe/snipe-it/pull/14277 * Improved UI for fieldsets by @snipe in https://github.com/snipe/snipe-it/pull/14279 ## New Contributors * @gitgrimbo made their first contribution in https://github.com/snipe/snipe-it/pull/13805 **Full Changelog**: https://github.com/snipe/snipe-it/compare/v6.3.0...v6.3.1