Prosody 0.11.10

Upstream is pleased to announce a new minor release from their stable branch.

This release primarily fixes CVE-2021-37601, a remote information disclosure vulnerability. See the previously released advisory for details. Upstream recommends that all deployments upgrade if they have not yet applied the mitigation described in the advisory.

Security

• MUC: Fix logic for access to affiliation lists CVE-2021-37601: https://prosody.im/security/advisory_20210722/

Minor changes

• prosodyctl: Add limits to known globals to warn about misplacing it
• util.ip: Fix netmask for link-local address range
• mod_pep: Remove obsolete node restoration code
• util.pubsub: Fix traceback if node data not initialized