CiviForm version 3.25.0 is now available

[Shane McDaniel]

v3.25.0

What's Changed

This release enables Session Replay protection as a security measure to prevent session hijacking and replay attacks. This means any user with an active session will be automatically logged out after a configured length of time. The default is 600 minutes (10 hours), but this can be customized by setting maximum_session_duration_minutes to the desired session duration in minutes in your deployment configuration file.

To disable this feature, set session_replay_protection_enabled=false in the deployment configuration file.

Additionally this release includes additional resources and handling for the server.

• It increases the production heap size from 1GB to 3GB to more fully utilize the existing memory allocation.
• It sets the maximum size of internal caches to prevent memory exhaustion.

Enhancements

• Set JVM heap size to 3GB using .jvmopts as single source of truth by @nb1701 in #12887
• Only require selector notation when enumerator feature flag is off by @CallaJune in #12848
• [Session Replay] default session replay protection to true by @tallulahkay in #12812
• Clean up Settings code and add tests by @shane-exygy in #12894

Bug fixes

• Set maximum sizes for caches by @nb1701 in #12885

Under Development

• [Enumerator] Move unique admin name generation to helper class by @AlvieH in #12860
• Prevent users from adding questions to repeated sets until questions exist by @CallaJune in #12846
• [Session Timeout] update last activity time on allowed routes by @tallulahkay in #12898
• swap disabled to readOnly by @fernandez-jack in #12921
• [Account Merge] Add Feature Flags and skeleton for usage. by @shane-exygy in #12801
• [Session Timeout] invalidate the session in the filter if the session has expired by @tallulahkay in #12917
• Add nested repeated set button by @CallaJune in #12882
• [Session Timeout] move all session logic into session filter by @tallulahkay in #12900
• [Session Timeout] enable session timeout by default in dev and clean up old feature flags by @tallulahkay in #12949

Dependencies

• Update dependency sbt/sbt to v1.12.5 by @renovate[bot] in #12872
• Update dependency org.checkerframework:dataflow-errorprone to v3.54.0 by @renovate[bot] in #12878
• Update dependency globals to v17.4.0 by @renovate[bot] in #12870
• Update dependency globals to v17.4.0 by @renovate[bot] in #12871
• Update dependency postcss to v8.5.8 by @renovate[bot] in #12880
• Bump immutable from 5.1.3 to 5.1.5 in /server by @dependabot[bot] in #12897
• Update dependency io.swagger.core.v3:swagger-core to v2.2.44 by @renovate[bot] in #12902
• Update awssdk to v2.42.6 by @renovate[bot] in #12901
• Update dpage/pgadmin4 Docker tag to latest commit by @renovate[bot] in #12905
• Update dependency dompurify to v3.3.2 by @renovate[bot] in #12908
• Update quay.io/keycloak/keycloak:26.5 Docker digest to latest commit by @renovate[bot] in #12909
• Update awssdk to v2.42.7 by @renovate[bot] in #12915
• Update dependency @types/node to v24.12.0 - autoclosed by @renovate[bot] in #12919
• Update dependency oidc-provider to v9.7.0 by @renovate[bot] in #12925
• Update awssdk to v2.42.8 by @renovate[bot] in #12926
• Update grafana/grafana Docker tag to latest commit by @renovate[bot] in #12931
• Update awssdk to v2.42.9 by @renovate[bot] in #12936

Other changes

• Adding missing eslint dev package by @gwendolyngoetz in #12911
• add comments to clarify the last activity times by @tallulahkay in #12918
• [Settings Cache] remove settings cache feature flag by @tallulahkay in #12743
• [Maps] remove map question feature flag by @tallulahkay in #12744
• [Session Timeout] update session timeout language by @tallulahkay in #12959

Full Changelog: v3.24.0...v3.25.0