v1.0.15

[1.0.15] - 2024-10

Changed

• Updated dependencies to mitigate CVE-2024-21536
• Add poetry.lock to pin dependency versions for Python code
• Adapt build scripts to use Poetry for dependency management

v1.0.14

[1.0.14] - 2024-10

Changed

• Remove dependencies bootstrap and datefns
• Allow backend to accept uppercase http headers, to prevent errors when receiving uppercase Content-type
• Replace pip3/requirements.txt dependency management with Poetry

Added

• Add poetry.lock file to support reproducible builds, improve vulnerability scanning

v1.0.13

[1.0.13] - 2024-9

• Upgrade rollup to mitigate CVE-2024-47068

v1.0.12

[1.0.12] - 2024-9

Fixed

path-to-regexp to mitigate CVE-2024-45296

v1.0.11

[1.0.11] - 2024-9

Fixed

• Added support for keys aws:SourceOrgID, aws:SourceOrgPaths in policy conditions

Updated dependencies

• moto from v4.x to v5.x for python unit tests
• micromatch to mitigate CVE-2024-4067
• webpack to mitigate CVE-2024-43788
• express to mitigate CVE-2024-43796
• send to mitigate CVE-2024-43799
• serve-static to mitigate CVE-2024-43800
• path-to-regexp to mitigate CVE-2024-45296
• body-parser to mitigate CVE-2024-45590

v1.0.10

[1.0.10] - 2024-8

• Upgrade axios to mitigate CVE-2024-39338

v1.0.9

[1.0.9] - 2024-08

Security

• Upgrade fast-xml-parser to mitigate CVE-2024-41818

Fixed

• When scan fails for a certain S3 bucket, the solution will no longer fail the scan for all S3 buckets in the account.
  The failed buckets will be reported as individual failures with bucket name in on the solution UI, while scan results
  for all other buckets will be reported successfully.

v1.0.8

Fixed

• Updated package versions to resolve security vulnerabilities.

v1.0.7

Fixed

• Updated package versions to resolve security vulnerabilities.

v1.0.6

Fixed

• Updated package versions to resolve security vulnerabilities.
• Pinned boto3 and botocore versions to ~1.34.0