Passbolt Release Note: 4.9.0

B.Y.O.B.

Passbolt v4.9.0 is a significant update that addresses long-standing user requests, enhances performance, and adds a new administrative tool to manage your LDAP/AD integration with confidence.

In this release, a highly requested feature was introduced where the grid now displays the location of resources. This addition provides extra meta information to help users efficiently identify passwords and where they are located. Additionally, the search functionality has been improved to use resource locations as meta information. Users can now retrieve a resource by using the names of its parent folders, which can greatly simplify the process of finding passwords depending on your organisation's classification system.

*Fig. 1 Search a resource in a folder & folder location in the grid*

The team has also focused on various performance improvements to meet the growing needs of organisations managing an increasing number of passwords. These enhancements also prepare the way for the upcoming v5.0.0, which will support more content types and include an additional encryption layer. Both the API and the browser extension have been optimised, resulting in a 50% improvement in retrieving and treating collections of resources, according to our benchmarks.

Moreover, administrators managing their users with LDAP will benefit from a new feature designed to protect against unforeseen deletion of users. This new option allows administrators to choose a suspend strategy, which locks a user's access to Passbolt without deleting any material, providing an extra layer of security.

*Fig. 3 Suspend strategy for users deleted in the user directory integration settings*

We extend our gratitude to the community for their feedback and assistance in testing this release. We hope these updates enhance your experience with Passbolt and we look forward to hearing from you.

API

Added

PRO PB-33828 As an administrator I can define the deletion behaviour of users to suspended instead of deleted on directory synchronisation
PRO PB-33014 As an administrator I want to know if TLS/SSL verification is disabled when connecting to LDAP server
PRO PB-32284 As an administrator I can set the Default OpenID Connect param alg as optional as specified by the RFC
PB-33690 Improves response times by adding an index to gpgkeys.user_id column
PB-33639 Adds additional contain parameters to share/search-aros.json for enhanced performance
PB-33936 Adds a has-users filter to gpgkeys.json index endpoint
PB-33813 Adds a fixed limit to the search-aros.json endpoint

Improved

PRO PB-33688 Improves the performance of tags.json index endpoint
PRO PB-33650 Improves the performance of resources.json when retrieving tags
PB-33429 As a user I should retrieve resources and folders parent folders in a single query
PB-33826 Improves the performance of resources.json by improving the datetime fields processing
PB-24995 Improves last_logged_in property query performance to reduce response time of users.json endpoint
PB-33653 Improves is_mfa_enabled property query performance to reduce response time of users.json endpoint
PB-33702 Improves has-access filter performance on users.json
PB-32591 Validate passbolt.plugins.smtpSettings.security configuration values before passing it to SMTP server
PB-33214 Update sql export / improve mysql backup command compatibility with mariadb-dump

Security

PB-33747 Fix command injections vulnerabilities in composer/composer package

Fixed

PRO PB-33427 As a user logging-in with Azure SSO I should not get a 500 if the secret is expired
PRO PB-33881 Fixes a typo for the OAuth2 environment variable
PB-33616 As a user creating a resource I should get a validation error if the secret is a string and not an array
Fix missing "is" in the database schema up to date sentence (GITHUB #517)

Maintenance

PB-33692 Bump enygma/yubikey to v3.8

Browser extension