Magda Files

Magda v7.1.0 moves every Node.js-based service and module to a Node.js release with the October 2026 security fixes: CVE-2026-111497 (Brotli decoder remote code execution) and the eMudhra intermediate CA compromise. It also adds opt-in WebSocket proxying to the gateway, fixes owner-scoped Storage API permissions, and fixes the compiled UI stylesheet's ordering and missing map styles.

Node.js security update

All Node.js images now run Node v22.23.4, or v24.22.1 for the modules built on Node 24. Both releases fix CVE-2026-111497 and the eMudhra CA issue.

• Magda services: all built on node:22-alpine. magda-scss-compiler moves from Node 20 and magda-semantic-search-api from Node 18.
• Modules (new releases, now used by the charts):

The auth plugins aren't part of the magda chart: if you install them yourself, upgrade them to the versions above. The local-deployment chart already uses the new versions.

Known issues

• The optional magda-opensearch-dashboards image (off by default) still bundles Node 18 from OpenSearch Dashboards 2.19.1, so it doesn't have these fixes.
• magda-pdf-semantic-indexer can be OOM-killed by large scanned PDFs, and then stops indexing PDFs ([magda-io/magda-pdf-semantic-indexer#7](https://github.com/magda-io/magda-pdf-semantic-indexer/issues/7)). This isn't caused by this release. As a workaround, raise its memory limit (e.g. to 2.5Gi).

What's Changed

• #3888: Move magda-scss-compiler (from Node 20) and magda-semantic-search-api (from Node 18) to Node 22 (node:22-alpine), and fix two scss-compiler issues:
• The compiled UI stylesheet could differ between runs, because the SCSS files were compiled in a random order.
• The map styles (Leaflet CSS) were missing from the compiled UI stylesheet, and a broken @import was left in its place.
• #3888: Upgrade magda-embedding-api to 1.2.0 and magda-preview-map to 2.1.1.
• #3888: Upgrade the connectors, minions, OpenFaaS functions & auth plugins to Node v22.23.4: magda-ckan-connector 2.2.0, magda-csw-connector 2.1.0, magda-project-open-data-connector 2.1.0, magda-dap-connector 2.1.0, magda-minion-linked-data-rating 2.1.0, magda-minion-visualization 2.1.0, magda-minion-ckan-exporter 2.1.0, magda-minion-broken-link 3.1.0, magda-function-history-report 2.1.0, magda-function-esri-url-processor 2.1.0, magda-auth-google 4.0.1, magda-auth-internal 4.0.1, magda-auth-arcgis 3.0.1 & magda-auth-facebook 3.0.1.
• #3888: Upgrade magda-minion-format to 2.0.3, magda-pdf-semantic-indexer to 1.0.2 and magda-csv-semantic-indexer to 1.0.0-alpha.3 (Node v24.22.1).
• #3859: Fix owner-scoped storage/object/* permissions not matching objects uploaded through the Storage API (closes [#3853]). Uploads now store the owner under the magda-owner-id metadata key that authorization reads. Objects uploaded by earlier versions (owner stored under magda-user-id) keep their owner. Replacing an existing object now keeps its owner, and is authorised against the existing object's owner, not the uploader.
• #3843: Add opt-in WebSocket proxying to magda-gateway routes (websocket: true). WebSocket connections are checked by the same authentication and access control as other requests, and only accepted from the Magda site's own origin by default (configurable via websocketAllowedOrigins).

Full Changelog: https://github.com/magda-io/magda/compare/v7.0.1...v7.1.0