Release: v1.1.2 — a security fix in search, and a markdown field for the admin

A search request can narrow its results with filters, and on PostgreSQL the filter key from the request body was pasted straight into the SQL. A key with a quote in it could end the string and add conditions of its own — including ones that match documents past the tenant filter, so one tenant could search another’s index.

The key is now a bound parameter, like the value always was. Every release from 1.0.0 to 1.1.1 is affected; nothing else in your app needs to change. Until you can upgrade, put a check in front of the search routes that rejects any filter key your indexes don’t define.

Details are in advisory GHSA-gg3m-qgmj-w23v.

The LIKE fallback that other databases use had a smaller cousin of the same bug: a quote or backslash in a filter value stopped it from matching. Values are now encoded the way they are stored, so they match.

A customer project needed editors to write formatted text in the admin, so fields can now be :widget :markdown. It renders a textarea marked data-markdown; point the field’s :editor-script at your own script and it becomes whatever editor you like. Without a script it stays a plain textarea, so nothing is loaded you didn’t choose.

bb scaffold ai knows the widget too, so a generated module can ask for one.

An email with :html-body now goes out as multipart/alternative, with :body as the plain-text part. Before, the SMTP transport dropped the HTML without a word. If you never set :html-body, nothing changes.

Then pin 1.1.2 for every com.wagoe/* dependency. All 33 artifacts are on 1.1.2.

The full list is in the CHANGELOG.