We have migrated several controllers and APIs to the new permission model and removed legacy role and identity components, improving security and maintainability. The API specification now enforces stricter validation for string and integer inputs to reduce the risk of invalid or malicious data. Additionally, list pages with persisted sorting now load with a single HTTP request, improving performance and reducing unnecessary traffic.
Improvements
Permissions
- ROLEX-2499: Migrate recipe tag permissions to the new authorization model
- ROLEX-2500: Migrate tenant permissions to the new authorization model
- ROLEX-2666: Migrate system-actions permissions to the new authorization model
- ROLEX-2501: Migrate install-controller APIs to the new authorization model
- ROLEX-2667: Remove deprecated role and identity controllers and their UI to streamline security management
API specification
- ROLEX-2664: Tighten API string input validation to improve security of the API specification
- ROLEX-2663: Add format and min/max bounds to integer schemas in the API specification to enforce stricter validation
Other
- ROLEX-2631: Delete updatable modules automatically when a
THING_DELETEDDMF message is received i.e., when a IoT Rollouts target is deleted
Bugs fixed
- ROLEX-2648: Eliminate duplicate HTTP requests on list pages when a persisted sort is active