v2.1.26

nocobase/nocobasev2.1.26Jul 17, 2026by nocobase[bot]

AI Summary

Updated data source documentation and addressed security vulnerabilities regarding file uploads and database metadata reading.

Key Highlights

  • Updated the data source documentation structure, links, and localized pages.
  • Prevented uploaded XML and other active content files from executing scripts.
  • Fixed an SQL injection risk when reading database view metadata.
  • Fixed S3-compatible file URLs omitting the configured storage path.

Full Release Notes

### 🚀 Improvements

- **[undefined]**
  - Updated the data source documentation structure, links, and localized pages. ([#10108](https://github.com/nocobase/nocobase/pull/10108)) by @hongboji
Reference: [Data sources](docs/docs/en/data-sources/index.md)
  - Updated the data source documentation structure, links, and localized pages. ([#10108](https://github.com/nocobase/nocobase/pull/10108)) by @hongboji
Reference: [Data sources](docs/docs/en/data-sources/index.md)
### 🐛 Bug Fixes

- **[server]** Prevented uploaded XML and other active content files from executing scripts in the application origin ([#10104](https://github.com/nocobase/nocobase/pull/10104)) by @mytharcher

- **[database]** Fixed an SQL injection risk when reading database view metadata ([#10115](https://github.com/nocobase/nocobase/pull/10115)) by @2013xile

- **[client-v2]**
  - Reset unwanted border and shadow styles on Markdown h2 headings. ([#10107](https://github.com/nocobase/nocobase/pull/10107)) by @katherinehhh

  - Corrected the Urdu label and added a separate Uzbek option to the System Settings language list. ([#10090](https://github.com/nocobase/nocobase/pull/10090)) by @hongboji

- **[AI employees]** Fixed an error when sending files pasted into the AI employee chat input ([#10106](https://github.com/nocobase/nocobase/pull/10106)) by @cgyrock

- **[File storage: S3(Pro)]** Fixed S3-compatible file URLs omitting the configured storage path, which caused uploaded logos and attachments to return 404 errors by @mytharcher