Skip to content

v2.5.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jun 17:06
v2.5.4
8f8a11b

Highlights

  • Added "Import Dataset" feature: import datasets from remote Registry instances or archive URLs, with full SSRF protection and resource guards.
  • Switched file uploads to streaming mode with a configurable size limit, reducing memory usage for large files.
  • Fixed multiple security issues in archive extraction and outbound HTTP requests.

Added / Changed

  • Added "Import Dataset" as a heavy tool, supporting imports from remote Registry instances and archive URLs.
  • Added browsing of remote organizations and datasets when importing from another Registry.
  • Added SSRF (Server-Side Request Forgery) protection for all outbound HTTP requests during import, including IPv6 safeguards and DNS rebinding prevention.
  • Added extraction budget system to prevent resource exhaustion during archive extraction.
  • Added import credential protection using ASP.NET Core Data Protection.
  • Switched file uploads to streaming mode, replacing the previous buffered approach. Files stream directly to the target volume with only a 1 MiB buffer in memory.
  • Added configurable upload size limit via ConfigurableUploadSizeLimitAttribute.
  • [Hub] Added import dataset UI for browsing and importing remote datasets.
  • [Hub] Added copy button to embed iframe.
  • [Hub] Reduced orbit radius in Gaussian Splat viewer for a more immersive initial view.
  • [Hub] Added share functionality for individual files, not just datasets.
  • Improved Redis connection handling: now reuses the shared singleton instead of opening a second connection.
  • Improved timeout handling for import operations with dedicated tests.
  • Improved remote registry validation and fetch logic, with clear error messages for authentication failures and empty datasets.
  • Fixed Scalar API documentation viewer crashing on STAC/metadata endpoints due to infinite recursion.
  • Added XML documentation to OpenAPI spec for better API reference.
  • Improved README build instructions.

Fixed

  • [Security] Fixed SSRF vulnerability in outbound HTTP requests during import operations.
  • [Security] Improved archive extraction guards to prevent path traversal and resource exhaustion.
  • Fixed Scalar API documentation viewer crashing with "Maximum call stack size exceeded" error.

Merged PRs

  • #348 Upload optimizations
  • #349 Add import dataset

Full Changelog: v2.5.3...v2.5.4

Assets 9
Loading