Meshery
v1.0.77Provisioning & Runtime2026年11月12日
正確性と入力検証、UIとCLIの堅牢性に焦点を当てたメンテナンスリリースです。リモートURLインポートの`SSRF`対策と、`mesheryctl`の引数検証に関わる変更が含まれます。
影響確認 (2)
securityリモートURLインポートの
SSRF対策リモートURLのインポートを使用する場合に適用されます。
ServerのリモートURLインポートで、SSRFを防ぐ保護を追加します。breakingsystem provider view の引数検証
mesheryctlを実行する場合に適用されます。mesheryctlの system provider view で、引数が正確に検証されます。
その他の記録済み変更 31 件すべてfixes 14 · value changes 14 · additions 2 · constraints 1
fixes (14)
- - [Server] Guard nil dereferences for user, SystemID, provider, and connection in telemetry handlers @Amansingh0807 (#23338)
- - [Server] Guard nil MesheryInstanceID and typed-nil INSTANCE_ID in K8s context paths @piyxsh31 (#23305)
- - [Server] Prevent nil pointer dereference on unauthenticated /user/logout @Supersaiyan101 (#23311)
- - [Server] Evict state machine from tracker on DeleteContext error @Atharva-Mendhulkar (#23256)
- - [Server] Probe NOTFOUND Kubernetes connections so their unreachable condition can resolve @dropps07 (#23235)
- - [mesheryctl] Fix nil dereference and slice bounds panic in
environment view@abhinavkdeval08-design (#23365) - - [mesheryctl] Guard nil timestamp and UUID fields across design and filter commands @Swarup-Banik (#23325)
- - [mesheryctl] Fix connection view empty-slice panic when TotalCount > 0 @Swarup-Banik (#23328)
- - [mesheryctl] Fix Kubernetes log stream descriptor leak in system logs @muskan-creates352 (#22471)
- - [mesheryctl] Fix file descriptor leak in model init @muskan-creates352 (#22438)
- - [UI] Fix search paging and Count sort in the database summary table @mayank609 (#23282)
- - [Server] Dedup inventory parent additions across relationship copies @yi-nuo426 (#23366)
- - fix(mesheryctl): sanitize spaces and path separators in relationship view --save filename
- - fix(mesheryctl): escape model path and validate input in relationship view
value changes (14)
- - [mesheryctl] Use MeshKit errors for token assignment and rollback @piyxsh31 (#23340)
- - [mesheryctl] Respect -c/--context across system token create, set, and view @piyxsh31 (#23317)
- - [mesheryctl] Replace path separators in file names saved by component view @RajJasani (#23300)
- - [mesheryctl] Honor the --context flag in system dashboard, login and logout @mayank609 (#23280)
- - [mesheryctl] Return actionable error for unsupported meshery publish target @Rohith-Saran (#23270)
- - [UI] Handle empty component.schema in LazyComponentForm @abhinavkdeval08-design (#23357)
- - [UI] Offer every credential in the connection wizard and MeshSync stepper @ChackoPAbraham19 (#23334)
- - [UI] Paginate the Credentials table on the server @ChackoPAbraham19 (#23243)
- - [UI] Guard missing cluster context in Dashboard View and enforce RBAC query skip checks @piyxsh31 (#23319)
- - [UI] Keep failed notification page requests retryable @ayushgade06 (#22805)
- - [UI] Enforce RBAC skip guards on connections, preferences, and registry @piyxsh31 (#23295)
- - [UI] Disable LegacyRJSFModal submit while pending and add submitDisabled @piyxsh31 (#23299)
- - [UI] Reset to the first page when searching performance results @mayank609 (#23284)
- - [UI] Skip unauthorized queries in Dashboard charts when view permissions are denied @piyxsh31 (#23272)
additions (2)
- - [Helm] Add env.MESHSYNC_DEFAULT_DEPLOYMENT_MODE with embedded default @ayushbuilds-code (#23291)
- - [mesheryctl] Added Port Fallback To Unused Port @tanav29 (#22308)
constraints (1)
- - [mesheryctl] Parse positional mesh name argument in adapter deploy and remove (#23275) @muskan-creates352 (#23276)
Mesheryをスタックに追加
対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。