v1.5.6 1.23.2
parruda/swarmSep 29, 2026 → Sep 29, 20260 days between releases
What's New
Adds SECRET_KEY hardening, SSRF protection, and file sandboxing.
Breaking Changes
- pip installs: rotate your SECRET_KEY if other users can read the data directory.
- Image exports skip media on private networks.
- Uploaded HTML, SVG, and XML files open in a sandbox.
New Features
- SECRET_KEY permission hardening
- SSRF protection in image exports
- File sandboxing for uploaded content
- DNS rebinding protection
Upgrade Notes
Rotate your SECRET_KEY by deleting the line from .env or setting a new environment variable, as older versions allowed other users to read it. If your task media is hosted on an internal server, configure SSRF_PROTECTION_ENABLED or USER_ADDITIONAL_BANNED_SUBNETS. Set LABEL_STUDIO_HOST to ensure image exports include uploaded files.
The Two Releases
Clypra v1.5.6
Sep 29, 2026· 23 days ago
Minimal release notes: "Automated multi-platform release bundle — macOS (arm64), Windows (x64), Linux (x64)."
Full release notes1.23.2
Sep 29, 2026· 23 days ago
Security release improving file permissions for SECRET_KEY, blocking private network access in image exports, and sandboxing uploaded HTML/SVG/XML files.
Full release notes