Skip to content

Release history

GlobaLeaks releases

Whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.

All releases

12 shown

Review required
v5.0.99 Security relevant
Auth RBAC

OTP cooldowns + usage alerts

No immediate action
v5.0.98 Maintenance

Routine maintenance and dependency updates.

Review required
v5.0.97 Bug fix
Auth Breaking upgrade

Serialization fix

Review required
v5.0.96 Security relevant
Auth RBAC Breaking upgrade

DPoP + tenant isolation

No immediate action
v5.0.95 Bug fix

iOS fix

Review required
v5.0.94 Breaking risk
Auth RBAC Dependencies

CVE‑2024‑41671 token hashing fix

Review required
v5.0.93 Security relevant
Auth RBAC

Cross‑tenant security hardening

v5.0.92 Bug fix

Bug fixes and stability improvements in GlobaLeaks.

Full changelog

Changes in version 5.0.92

  • Add tid constraint to user and tip queries
  • Implement key restrictions on rtip 'set' operation
  • Remove usage of random.sample and random.randint in favor of secrets functions
  • Fix issue #4821
  • Bump client dependencies to latest stable versions
  • [doc] Remove oudated documentation about client exceptions
v5.0.91 Bugfix

Fixed admin UI issues when reordering users, contexts, and questions.

Full changelog

Changes in version 5.0.91

  • Fix admin UI in relation to reordering of users, context and questions
  • Bump client dependencies to latest stable versions
v5.0.90 Bug fix
Notable features
  • Added receipt page when homepage is set to /submission
  • Added Mongolian translation
Full changelog

Changes in version 5.0.90

  • Add receipt page when homepage is set to be /submission
  • Fix failure in gl-admin backup (#4811)
  • Fix search site function by tenant number (#4810)
  • Fix regression on search filter on sites list (#4803)
  • Fix reordering of reports using column filters (#4802)
  • Fix issue #4800
  • Bump client dependencies to latest stable versions
  • Add mongolian translation
  • Update translations
v5.0.89 Breaking risk
⚠ Upgrade required
  • Client dependencies have been bumped to their latest stable versions.
  • Translations have been updated.
Breaking changes
  • Deleting a channel is now blocked if any report exists within that channel (#4574).
Notable features
  • Path validation and input format checks for password reset tokens
  • Ability to select the homepage among '/' and '/submission' (#4796)
  • URL defanging for untrusted support user input and deriving support URL from server hostname (#4794)
Full changelog

Changes in version 5.0.89

  • Fix gl-admin restore command failing with missing directory error
  • Add path validation and input format checks for password reset tokens
  • Prevent to delete a channel till areport in such channel exists (#4574)
  • Replace integration with Transifex with integration with Weblate (#4755)
  • Revise footer moving Custom Footer below Policies (#4767)
  • Prevent configuring the data retention policy on intermediate substatuses
  • Fix bug causing reset of submission substatuses configurations
  • Make it possible to select which page should be the homepage among / and /submission (#4796)
  • Implemented URL defanging for untrusted support user input (#4794) and
    updated code to derive the support URL from the server hostname
    (thanks to @zaphoxx)
  • Fix issue #4754, #4764, #4769
  • Bump client dependencies to their latest stable versions
  • Update translations
v5.0.88 Bug fix

Fixed bug that prevented the gl-admin script from restarting the service after a backup.

Full changelog

Changes in version 5.0.88

  • Fix sorting on reports' list (#4730)
  • Improve UI in relation to masked files (#4724)
  • Enable angular zoneless mode (#4632)
  • Avoid to compress images with brotly since they are already optimized
  • Optimize PDF.js packaging
  • Fix bug preventing gl-admin script to restart the service after backup (#4714)
  • [doc] Revise documentation about No-Cookies Policy and usage of Session Storage
  • Bump client dependencies to latest stable versions
  • Update translations

Beta — feedback welcome: [email protected]