- Favorite Services:: Users can now mark services as favorites, making them easily accessible from the dashboard for quick access.
- PostgreSQL Major Version Upgrade: Services running a non-latest PostgreSQL version can now be upgraded directly from the service overview page. Upgrades are performed one major version at a time to ensure stability and data integrity.
- Service Restore: Users can now restore services from the overview page using a timestamp or backup. The restore button is located next to “Create from backup”.
- Maintenance Windows: Schedule maintenance for PostgreSQL and PGEE services during service creation or plan changes.
- Service Header: Redesigned the display of service resource information and improved page load speeds
- Firewall settings:
- Users can now manage allowed IP address ranges for PostgreSQL, PGEE and Babelfish services.
- Removed default pg_hba entries
- Removed the obsolete Search field when adding organization users
- Send an informational email when updating the password in the profile
- Organization Read-Only Role: New organization role that provides view-only access to all projects and services within the organization.
- Improved chart responsiveness and added on-hover tooltips
- The list of available countries has been updated to include Estonia, Poland, Uruguay, India, and South Africa
- Service charts:
- Nodes chart displays the status and storage consumption of each node, with the ability to add extra replicas directly from the chart.
- Backup size histogram shows the sizes of logical and continuous backups for easier tracking and comparison.
- Refreshing the page while on a services Application tab resulted in a blank page
- Refreshing the page while on a services Plan tab crashes the page
- Fixed an issue where malformed passwords displayed a translation key instead of the correct message.
- Fixed an issue where modifying the ACL of a Babelfish service could prevent the instance from starting
- Dragging a row in the ACL tab crashes the page
- Cloning the PosgtreSQL parameters of a source clusters now adjusts them according to the available resources of the new cluster
- ACL rules (pg_hba) were not displayed correctly for Babelfish clusters.
- Fixed validation issue with default price value of 0 in Support Plan form
Unauthorized: The session is expired or missing when downloading a logical backup
- CVE-2024-12905:
tar-fs (indirect dependency of canvas and sharp; used for image processing; affected feature is not used) - CVE-2025-27152:
axios (direct dependency for HTTP requests; the affected feature (baseURL) is not in use) - CVE-2025-27611:
base-x (direct dependency for generating magic links; affected feature is exposed to external input, no vulnerability) - CVE-2025-27789:
@babel/runtime (indirect dependency of routing-controllers; used for handling HTTP requests; potential for inefficient RegExs) - CVE-2025-32395 and CVE-2025-46565:
vite (indirect dependency of vitest; used for automated tests; affected only during development, no vulnerability) - CVE-2025-32996:
http-proxy-middleware (direct dependency for serving Migrator/CYPEX; affected feature is not used, no vulnerability) - CVE-2025-43865:
react-router (direct dependency for facilitating routing in the GUI; affected feature is not used, no vulnerability) - CVE-2025-47944, CVE-2025-48997 and CVE-2025-7338:
multer (direct dependency for file uploads; potential for denial of service) - CVE-2025-7783:
form-data (indirect dependency; affected feature is not used, no vulnerability) - CVE-2025-12758:
validator (indirect dependency of class-validator; used for input validation; affected feature is not in use, no vulnerability) - CVE-2025-65945:
jws (indirect dependency of jsonwebtoken; used for HS256 signature verification; affected feature is not in use, no vulnerability) - CVE-2025-15284:
qs (indirect dependency of cypress; affected feature is not used, no vulnerability) - CVE-2026-21884:
react-router (direct dependency for facilitating routing in the GUI; affected feature is not used, no vulnerability) - CVE-2025-13465:
lodash (direct dependency for utility functions; affected feature is exposed to external input, no vulnerability) - CVE-2025-14874:
nodemailer (direct dependency for sending emails; potential for denial of service) - CVE-2026-23745:
tar (indirect dependency of node-gyp and cacache; affected only during build time, no vulnerability) - GHSA-67mh-4wv8-2f99:
esbuild (direct dependency for JS bundling; affected only during development, no vulnerability) - CVE-2026-25896:
fast-xml-parser (indirect dependency of @aws-sdk/client-s3; affects XML parsing at runtime, affected feature is not in use, no vulnerability) - CVE-2026-39365:
vite (indirect dependency of vitest; affected only during development, no vulnerability) - CVE-2026-27606:
rollup (indirect dependency of vitest; affected only during build time, no vulnerability) - CVE-2025-62718:
axios (direct dependency for HTTP requests; the affected feature (proxy:) is not in use) - CVE-2026-26318:
systeminformation (indirect dependency of cypress; affected only during build time, no vulnerability) - CVE-2026-33151:
socket.io-parser (indirect dependency of @roarr/cli; potential for denial of service) - CVE-2026-3520:
multer (direct dependency for file uploads; potential for denial of service) - CVE-2026-33228:
flatted (indirect dependency of eslint; affected only during development, no vulnerability) - CVE-2026-4800:
lodash (direct dependency for utility functions; affected feature is not in use, no vulnerability) - CVE-2026-33671:
picomatch (indirect dependency; affected feature is not in use, no vulnerability) - CVE-2026-29786, CVE-2026-31802 and CVE-2026-26960:
tar (indirect dependency of node-gyp and cacache; affected only during build time, no vulnerability) - CVE-2026-27959:
koa (indirect dependency of routing-controllers; affected feature is not in use, no vulnerability) - CVE-2026-29063:
immutable (indirect dependency of draft-js; affected feature is exposed to external input, no vulnerability) - CVE-2026-4867:
path-to-regexp (indirect dependency of express; potential for denial of service)
- Removed the non-functioning Zones feature
- Upgraded the
react-router dependency to the latest major version - Updated Node.js to version 23
- Replaced session authentication with JWTs
- Configure default pg_hba of Babelfish services to use md5
- Replaced the date-handling package
moment with luxon due to its maintenance status
