Gateway 4.4.1

Itential Gateway 4.4.1 is a maintenance release containing two bug fixes and nine security fixes.

IssueDescription
Fixed module discovery cache corruption on concurrent read/write (ENG-26211)Fixed an issue where the module discovery cache failed to write non-JSON-serializable date fields and could become corrupted during concurrent reads and writes. The cache now handles these cases correctly.
Fixed audit log persistence failures under concurrent requests (ENG-26687)Fixed an issue where concurrent requests could cause audit log persistence failures due to SQLite database locks. Audit logs now persist correctly under concurrent load.
IssueDescription
Resolved interpretation conflict vulnerability in fast-uri and axios (ENG-26001)Upgraded the fast-uri and axios packages to resolve a security vulnerability.
Resolved multiple vulnerabilities in axios (ENG-26044, ENG-26048, ENG-26049, ENG-26051)Updated the axios package to version 1.18.0 to resolve multiple security vulnerabilities, including prototype pollution, resource allocation, and permissive input validation issues.
Resolved integer overflow vulnerability in immutable (ENG-26133)Updated the immutable package to resolve an integer overflow or wraparound vulnerability.
Resolved multiple vulnerabilities in nanoid (ENG-26401, ENG-26402, ENG-26855)Updated the nanoid package to version 3.3.17 to resolve multiple security vulnerabilities, including infinite loop and integer overflow issues.
Resolved resource allocation vulnerability in Gateway dependencies (ENG-26468)Updated the nanoid, immutable, js-yaml, brace-expansion, and dompurify packages to resolve Snyk-identified security vulnerabilities.
Resolved use-after-free vulnerability in Gateway dependencies (ENG-26532)Updated the aiohttp, Werkzeug, requests, and python-multipart packages to resolve a security vulnerability.
Resolved cross-site scripting (XSS) vulnerability (ENG-26642)Resolved a cross-site scripting (XSS) vulnerability in a Gateway dependency.
Resolved inefficient algorithmic complexity vulnerability (ENG-26643)Resolved a security vulnerability related to inefficient algorithmic complexity in a Gateway dependency.
Resolved multiple vulnerabilities in fast-uri (ENG-27080, ENG-27081, ENG-27082, ENG-27083)Updated the fast-uri package to version 3.1.6 to resolve multiple security vulnerabilities, including interpretation conflict, improper URL encoding handling, improper input validation, and double decoding issues.
ComponentVersion
automation_gateway4.4.51