Last updated
Case documents can no longer be downloaded from the wrong case
When downloading or retrieving a case document, the application now checks that the document actually belongs to the case in the request before returning it. Previously this check was only applied when editing or deleting a document, so a signed-in user could retrieve a document from another case by referencing it directly. The read and download paths now enforce the same check.
Hardened expression evaluation in Form Flow
Form Flow expressions are now evaluated in a restricted context, preventing expressions from reaching arbitrary Java types and methods.
Updated several dependencies to address reported vulnerabilities.
Last updated