v6.3.1

grokability/snipe-itv6.3.1Feb 15, 2024by snipe

AI Summary

A security and bug fix release addressing API checkout issues, XSS vulnerabilities, and upgrading several libraries to patch CVEs.

Key Highlights

  • Added Google Chat notifications support.
  • Fixed XSS vulnerability in file uploads.
  • Fixed accessory/consumable checkout via API.
  • Upgraded composer and symfony packages for security.

New Features

  • Google Chat notifications
  • Security upgrades for Composer, Symfony, and OAuth2

Full Release Notes

## ⚠️ IMPORTANT: Future versions of Snipe-IT will require PHP 8.1 or greater

## What's Changed
* Fixed accessory checkout via API not sending notification and not adhering to qty limit by @marcusmoore in https://github.com/snipe/snipe-it/pull/14181
* Removed initial check for assets, licenses, etc by @snipe in https://github.com/snipe/snipe-it/pull/14215
* Fixed company asset counts for dashboard widget by @snipe in https://github.com/snipe/snipe-it/pull/14216
* Fixed FD-40296 - mobile uploads sometimes uploading with incorrect orientation by @snipe in https://github.com/snipe/snipe-it/pull/14213
* Upgrade bootstrap-table from 1.22.1 to 1.22.2 #14199 by @snipe in https://github.com/snipe/snipe-it/pull/14217
* Added support for Google Chat notifications by @Godmartinz in https://github.com/snipe/snipe-it/pull/14191
* Security upgrade alpine from 3.18.5 to 3.18.6 #14178 by @snipe in https://github.com/snipe/snipe-it/pull/14218
* Fixed consumable checkout via API not sending notification by @marcusmoore in https://github.com/snipe/snipe-it/pull/14190
* Use parseEscapedMarkedownInline for more views by @gitgrimbo in https://github.com/snipe/snipe-it/pull/13805
* Fixed #14185 - Resurfaced `load_remote` in admin by @snipe in https://github.com/snipe/snipe-it/pull/14219
* Removed loading of assets for label count by @snipe in https://github.com/snipe/snipe-it/pull/14220
* Chunk data to reduce memory on large datasets when updating `next_audit_date` by @snipe in https://github.com/snipe/snipe-it/pull/14221
* Added tests around getIdForCurrentUser method by @marcusmoore in https://github.com/snipe/snipe-it/pull/14222
* Switch to bulk updating to handle audit interval updates by @snipe in https://github.com/snipe/snipe-it/pull/14227
* Fixed Select2 functionality in User bulk check-in Delete User by @Godmartinz in https://github.com/snipe/snipe-it/pull/14223
* Fixed: 404 Error on Importer When Uploading a .csv Under Certain Circumstance by @akemidx in https://github.com/snipe/snipe-it/pull/14228
* Fixes file upload XSS vulnerability [sc-24156] by @uberbrady in https://github.com/snipe/snipe-it/pull/14233
* Fixed the general webhook not notifying anymore by @Godmartinz in https://github.com/snipe/snipe-it/pull/14187
* Fixed select inputs un-select2-ifying on mobile by @Godmartinz in https://github.com/snipe/snipe-it/pull/14229
* Fixed barcodes crashing if asset was deleted by @snipe in https://github.com/snipe/snipe-it/pull/14240
* Revert "Fixed barcodes crashing if asset was deleted" by @snipe in https://github.com/snipe/snipe-it/pull/14241
* Fixed ReportsController to not try to return a serial if the item doesn’t exist by @snipe in https://github.com/snipe/snipe-it/pull/14243
* Return null if asset was hard-deleted/purged by @snipe in https://github.com/snipe/snipe-it/pull/14244
* Fixes Default Location Being Set During Asset Creation and Checkout by @spencerrlongg in https://github.com/snipe/snipe-it/pull/14188
* Bump codacy/codacy-analysis-cli-action from 4.3.0 to 4.4.0 by @dependabot in https://github.com/snipe/snipe-it/pull/14251
* Fixed accessory check in emails being sent when setting disabled by @marcusmoore in https://github.com/snipe/snipe-it/pull/14256
* Cleaned up navbar-custom-menu by @mauro-miatello in https://github.com/snipe/snipe-it/pull/14250
* Change how we check forward-looking upgrade requirements by @jerm in https://github.com/snipe/snipe-it/pull/14236
* Fixes CVE-2024-24821 by upgrading composer/composer by @joelpittet in https://github.com/snipe/snipe-it/pull/14245
* Fixes CVE-2022-24894 by upgrading symfony/http-kernel by @joelpittet in https://github.com/snipe/snipe-it/pull/14246
* Fixes CVE-2023-37260 upgrading league/oauth2-server by @joelpittet in https://github.com/snipe/snipe-it/pull/14247
* Added LDAP group tag to LDAP tests by @marcusmoore in https://github.com/snipe/snipe-it/pull/14255
* Fixed incorrect string for location not existing by @snipe in https://github.com/snipe/snipe-it/pull/14261
* Added serial and status label to asset maintenances page and API by @snipe in https://github.com/snipe/snipe-it/pull/14264
* Updated testing helper name by @marcusmoore in https://github.com/snipe/snipe-it/pull/14272
* Upgrade alpinejs from 3.13.3 to 3.13.5 by @snipe in https://github.com/snipe/snipe-it/pull/14274
* Upgrade webpack from 5.89.0 to 5.90.0 by @snipe in https://github.com/snipe/snipe-it/pull/14275
* Fixed the notification listener by @Godmartinz in https://github.com/snipe/snipe-it/pull/14268
* Fixed ambiguous query on supplier_id in maintenances by @snipe in https://github.com/snipe/snipe-it/pull/14276
* Resolve Duplicate Activity Logs for Imports by @spencerrlongg in https://github.com/snipe/snipe-it/pull/14172
* Fixes #14010 Adds Components and Licenses logs to Assets history view by @inietov in https://github.com/snipe/snipe-it/pull/14197
* Lower log level to warning on webhook failure by @snipe in https://github.com/snipe/snipe-it/pull/14277
* Improved UI for fieldsets by @snipe in https://github.com/snipe/snipe-it/pull/14279

## New Contributors
* @gitgrimbo made their first contribution in https://github.com/snipe/snipe-it/pull/13805

**Full Changelog**: https://github.com/snipe/snipe-it/compare/v6.3.0...v6.3.1