This release contains security fixes for users who use HTTP/2 (you use this if you have https enabled with the viewer by giving it a cert), notably, CVE-2023-44487 & CVE-2023-36478. This isn't strictly a 'security' issue, as it can only result in a denial of service attack.
0.6.5 was skipped to avoid potential problems due to a mistaken tag push a while back.
Expect the next major release to require JDK 21
Changed
- Improve version parsing logic
- Bump Javalin to 5.6.3
Added
- Add naive Rate limiting to callback endpoint
- Add 403 error when a user who is not a member of the guild attempts to sign in
Fixed
- Ignore pre-releases when checking for new updates
- Correct parsing of timestamps without nanoseconds from MongoDB