<div dir="ltr"><p>Hello ,</p><p>The Arvados team is pleased to announce Arvados 2.4.2.</p>
<p>This release includes a critical security update to address
vulnerability GHSL-2022-063, described below. We strongly recommend
that <em>all</em> installations of Arvados, especially those accessible via the
public Internet, upgrade to 2.4.2 as soon as possible. See
<a href="https://doc.arvados.org/v2.4/admin/upgrading.html">Upgrading Arvados</a> for
upgrade instructions.</p>
<p>In addition, this release includes several performance improvements,
usability improvements, and bug fixes.</p>
<h2 id="gmail-security-updates">Security updates</h2>
<h3 id="gmail-ghsl-2022-063">GHSL-2022-063</h3>
<p>GitHub Security Lab (GHSL) reported a remote code execution (RCE)
vulnerability in the Arvados Workbench that allows authenticated attackers
to execute arbitrary code via specially crafted JSON payloads.</p>
<p>This vulnerability is fixed in 2.4.2 (<a href="https://dev.arvados.org/issues/19316">#19316</a>)</p>
<p>It is likely that this vulnerability exists in all versions of Arvados up to 2.4.1.</p>
<p>This vulnerability is specific to the Ruby on Rails Workbench
application (“Workbench 1”). We do not believe any other Arvados
components, including the TypesScript browser-based Workbench
application (“Workbench 2”) or API Server, are vulnerable to this
attack.</p>
<h3 id="gmail-cve-2022-31163-and-cve-2022-32224">CVE-2022-31163 and CVE-2022-32224</h3>
<p>As a precaution, Arvados 2.4.2 includes security updates for Ruby
on Rails and the TZInfo Ruby gem. However, there are no known
exploits in Arvados based on these CVEs.</p>
<h2 id="gmail-new-features">New Features</h2>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/18984">#18984</a></p>
<p class="gmail-ticketdesc">The “Type” column filters in the Workbench 2 Projects view are now
expanded by default, and intermediate workflow steps are now hidden by
default.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/18203">#18203</a></p>
<p class="gmail-ticketdesc">In Workbench 2, after adding a metadata element to a Project or
Collection, the “key” is not cleared and focus remains on the “value”
field, making it easier to enter multiple values for the same key.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19177">#19177</a></p>
<p class="gmail-ticketdesc">There is now a configuration option for admins to disable the user
interface for the “sharing link” feature (URLs which can be sent to
users to access the data in a specific collection in Arvados without
an Arvados account), for organizations where sharing links violate
their data sharing policy.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/18975">#18975</a></p>
<p class="gmail-ticketdesc">Workflow logs on Workbench 2 now show “Main logs” by default, which is
a combination of the crunch-run, stdout and stderr logs. Following
scrolling has also been improved.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/16070">#16070</a></p>
<p class="gmail-ticketdesc">Workbench 2 now features a new panel showing the command line used to
invoke a workflow or workflow step.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19231">#19231</a></p>
<p class="gmail-ticketdesc">Workbench 2 now has options for smaller page sizes (10 and 20 items)
to speed up loading project contents.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19282">#19282</a>
<a href="https://dev.arvados.org/issues/19220">#19220</a></p>
<p>Added new method to the Java SDK to upload files via Keep Web API. The
Java SDK uses config parameter to fetch api token in KeepClient.</p>
<h2 id="gmail-bug-fixes">Bug Fixes</h2>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19192">#19192</a></p>
<p class="gmail-ticketdesc">Fixed an internal, silent failure in <code class="gmail-language-plaintext gmail-highlighter-rouge">keep-web</code> that would prevent use
of the manifest cache after <code class="gmail-language-plaintext gmail-highlighter-rouge">keep-web</code> was running for a while,
resulting in poor performance accessing files in Keep via HTTP, WebDAV
and S3 APIs until the service was restarted. <code class="gmail-language-plaintext gmail-highlighter-rouge">keep-web</code> now correctly
uses the cache and maintains consistent performance.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19153">#19153</a></p>
<p class="gmail-ticketdesc">In the Workbench 2 collection file browser, following the URL
resulting from “Copy to clipboard” will now open the file content in
the browser, instead of forcing a file download.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19297">#19297</a></p>
<p class="gmail-ticketdesc">Workbench 2 advanced search by metadata property now works as intended, instead of returning an error.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19305">#19305</a></p>
<p class="gmail-ticketdesc">When using the “breadcrumbs bar” to edit Project properties, the
existing metadata properties are now loaded correctly.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19296">#19296</a></p>
<p class="gmail-ticketdesc">Fixed Python SDK bug in <code class="gmail-language-plaintext gmail-highlighter-rouge">Collection.remove</code> where the <code class="gmail-language-plaintext gmail-highlighter-rouge">recursive</code> flag
was not propagated, preventing removal of more than one level of
directories. Recursively removing deep directory trees in Collections
now works as intended.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/18965">#18965</a></p>
<p class="gmail-ticketdesc">When navigating to destination on Workbench 2 but not logged in, the
user is redirected to a login page, and after logging in, now
correctly navigated back to the page they intended to visit.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19142">#19142</a></p>
<p class="gmail-ticketdesc">Workbench 2 “All processes” and “Subprocesses” panels now load faster
by limiting which fields of the container record are requested.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19321">#19321</a></p>
<p class="gmail-ticketdesc">When launching a workflow on Workbench 1, workflow inputs with “enum” type are now displayed and set correctly.</p>
<p class="gmail-ticketnumber"><a href="https://dev.arvados.org/issues/19280">#19280</a></p>
<p class="gmail-ticketdesc">When submitting very large workflows with <code class="gmail-language-plaintext gmail-highlighter-rouge">arvados-cwl-runner</code>,
particularly those defined entirely in a single file, the time spent
in initialization (before the first workflow step is submitted) has
been greatly reduced.</p><p class="gmail-ticketdesc"><br></p><p class="gmail-ticketdesc">Thanks,</p><p class="gmail-ticketdesc">The Arvados Team<br></p></div>