v4.11.0

Features:

• OKAPI-1054 WebClientFactory to avoid socket leaks (okapi-common)

Fixes:

• OKAPI-1051 log4j 2.16.0: replacing temporary fix by upstream fix (CVE-2021-45046)
• OKAPI-1052 okapi-common uses only optional maven dependencies

Other:

• #1166 Unused commons-lang3 removed

v4.10.0

Fixes:

• OKAPI-1050 -Dlog4j2.formatMsgNoLookups=true for Debian/Ubuntu package (CVE-2021-44228)
• OKAPI-1047 Disable log4j JDNI by removing JdniLookup class (CVE-2021-44228)
• OKAPI-1048 Hazelcast 4.2.2, logging log4j2
• OKAPI-1046 Log4j 2.15.0 fixing remote execution (CVE-2021-44228)
• OKAPI-1041 Fix warnings about _tenantPermissions version 2.0
• OKAPI-1037 Missing permission check, token cache and pre/post filter
• OKAPI-1038 Disable X-Okapi-Trace header by default
• Upgrade to testcontainters 1.16.2 - makes Okapi pass tests on Apple M1
• Upgrade to nuprocess 2.0.2
• Upgrade to cron-utils 9.1.6

Other:

• OKAPI-1044 Upgrade to Vert.x 4.2.1
• OKAPI-1043 okapi reinstall

v4.9.1

Fixes:

• OKAPI-1050 -Dlog4j2.formatMsgNoLookups=true for Debian/Ubuntu package (CVE-2021-44228)
• OKAPI-1047 Disable JDNI in log4j by removing JdniLookup class (CVE-2021-44228)
• OKAPI-1046 Log4j 2.15.0 fixing remote execution (CVE-2021-44228)
• OKAPI-1041 Fix warnings about _tenantPermissions version 2.0

v4.8.4

Fix:

• OKAPI-1046 Log4j 2.15.0 fixing remote execution (CVE-2021-44228)

v4.8.3

Fixes:

• OKAPI-1050 -Dlog4j2.formatMsgNoLookups=true for Debian/Ubuntu package (CVE-2021-44228)
• OKAPI-1047 Disable JDNI in log4j by removing JdniLookup class (CVE-2021-44228)

v4.7.5

Fix:

• OKAPI-1046 Log4j 2.15.0 fixing remote execution (CVE-2021-44228)

v4.7.4

Fixes:

• OKAPI-1050 -Dlog4j2.formatMsgNoLookups=true for Debian/Ubuntu package (CVE-2021-44228)
• OKAPI-1047 Disable JDNI in log4j by removing JdniLookup class (CVE-2021-44228)

v4.9.0

Features/improvements:

• OKAPI-1020 Allow interface list for require/provide
• OKAPI-1024 Add facility to remove obsolete modules
• OKAPI-1034 Supply module id for some tenant errors
• OKAPI-1029 Cache CORS requests using Access-Control-Max-Age header

Fixes:

• OKAPI-1015 /saml/login timeout
• OKAPI-1016 Support delegate preflight request
• OKAPI-1023 Pull module descriptors with bulk/batch, fix connection timeout
• OKAPI-1025 /_/proxy/tenants/{tenant_id}/upgrade with body
• OKAPI-1028 GET /_/proxy/modules with invalid JSON body hangs
• OKAPI-1031 "apt-get install okapi" should recreate /var/lib/okapi

Other:

• OKAPI-1035 Upgrade to Vert.x 4.1.4 OKAPI-1035

v4.8.2

This update has fixes to get mod-login-saml working.

• OKAPI-1015 /saml/login timeout
• OKAPI-1016 Support delegate preflight request
• OKAPI-1017 Update to Vert.x 4.1.0.CR1

v4.8.1

This release identical to 4.8.0 (except version), by mistake.