v2.1.5

Thu, 10 Apr 2025 00:00:00 GMT

Bug fixes:

* [Check limit to string::replace with regular expressions (#5636)](https://github.com/surrealdb/surrealdb/pull/5636)
* [Fixes long running FOR loops, adds script timeouts, improves HTTP redirect security, and optimizes task yielding for better performance](https://github.com/surrealdb/surrealdb/pull/5597)
* [Fix import injection security bug](https://github.com/surrealdb/surrealdb/commit/d1d41efca2279989799de4ee98ab65a926833a44)
* [Backport JS scripting mem exhaustion fix](https://github.com/surrealdb/surrealdb/commit/3a3ed2de477ce9044ab057c8215b671f9f7e73bf)
* [Implements `SURREAL_FILE_ALLOWLIST`](https://github.com/surrealdb/surrealdb/commit/5b3d73c43b18bcd794a390a2e290a2c0d6913531)
* [Improve error handling on value conversion (RPC / HTTP/SQL endpoint) (#5647)](https://github.com/surrealdb/surrealdb/pull/5647)
* [Introduces Regex size limit configuration](https://github.com/surrealdb/surrealdb/commit/b07272f62fd0889044e2c052f07f1f7853b6ab48)
* [Backport Allocation tracking (#5663)](https://github.com/surrealdb/surrealdb/pull/5663)
* [Add `is_beyond_threshold_check` (#5667)](https://github.com/surrealdb/surrealdb/pull/5667)
* [Add deal-store datasets to the upgrade test](https://github.com/surrealdb/surrealdb/pull/5739)
* [Add memory limit threshold check to all statements (#5704) (#5737)](https://github.com/surrealdb/surrealdb/pull/5704)

Security Advisories:

* [Uncaught exception in Net module leads to database crash](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g)
* [Server-takeover via SurrealQL injection on backup import](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42)
* [Memory exhaustion via nested functions and scripts](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr)
* [Local file read of 2-column TSV files via analyzers](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg)
* [Memory exhaustion via string::replace using regex](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq)
* [No JavaScript script function default timeout could facilitate DoS](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7)
* [CPU exhaustion via custom functions result in total DoS](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf)
* [Bypass of deny-net flags via redirect results in SSRF](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5q9x-554g-9jgg)