conjur

[1.24.0] - 2025-11-10

Changed

• Updated documentation to align with Conjur Enterprise name change to Secrets Manager. (CNJR-10965)

Security

• Upgrade Rails to v7 (CNJR-11466)
• Bumped rack to 2.2.19 to resolve CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919. CONJSE-2064, CONJSE-2065
• Remove the policy factory API endpoints from the config/routes.rb file to prevent...

[1.22.3] - 2025-08-12

Security

• Remove the policy factory API endpoints from the config/routes.rb file to prevent anyone being able to call these endpoints and trigger the marshal.load call. CONJSE-2038
• Fix unsafe shell command executions. CONJSE-2039. CONJSE-2041-2046.
• Remove vulnerable activestorage gem from the dependencies to address CVE-2025-24293. CONJSE-2050

[1.21.6] - 2025-08-12

Security

• Remove the policy factory API endpoints from the config/routes.rb file to prevent anyone being able to call these endpoints and trigger the marshal.load call. CONJSE-2038
• Bump nokogiri gem to resolve GHSA-353f-x4gh-cqq8. CONJSE-2031
• Remove vulnerable activestorage gem from the dependencies to address CVE-2025-24293. CONJSE-2050

[1.22.2] - 2025-06-30

Added

• Allow conjur administrator to enable additional signed headers for IAM authenticator. CNJR-10217

[1.22.1] - 2025-05-02

Security

• Improve headers handling in AWS IAM authenticator. CONJSE-2023
• Remove support for !include policy syntax in the policy parser. CONJSE-2019
• Block ability to create hosts in conjur branch in hosts factories. CONJSE-2015
• Add kind validation to all APIs. CONJSE-2018
• Improves host factory token validation to prevent creation without proper kind and id, and...