π This release includes patches for three security vulnerabilities:
- Insecure default configuration affects installations where REDASH_COOKIE_SECRET is not set explicitly (CVE-2021-41192)
- SSRF vulnerability affects installations that enabled URL-loading data sources (CVE-2021-43780)
- Incorrect usage of state parameter in OAuth client code affects installations where Google Login is enabled (CVE-2021-43777)
π And a couple features that didn't merge in time for 10.0.0
- Big Query: Speed up schema loading (#5632)
- β Add support for Firebolt data source (#5606)
- π Fix: Loading schema for Sqlite DB with "Order" column name fails (#5623)