Component Update

• Updated "log4j-1.2-api", "log4j-api", "log4j-core", "log4j-to-slf4j" libraries to version 2.16.0.

Component Update

• Updated "log4j-1.2-api", "log4j-api", "log4j-core", "log4j-to-slf4j" libraries to version 2.15.0 to fix CVE-2021-44228.

OAuth Authentication

• The user's name is extracted from their email address if a value cannot be obtained from the authentication server.
• If the custom OAuth Identity Provider supports Open ID Connect, Oxygen Feedback can be configured to extract the user's information (name and email address) from the provided OIDC ID Token.

Component Update

• Updated third-party library "jsoup" to version 1.14.2.
• Updated third-party libraries "spring-boot" to version 2.5.4, and "logback-core" to version 1.2.6.
• Updated third-party libraries "spring-boot" to version 2.5.6, and "tomcat-embed-websocket" to version 9.0.54.
• Updated the "thymeleaf" third-party library to version 3.0.13.RELEASE, and "thymeleaf-spring5" to version 3.0.13.RELEASE.

Oxygen Feedback Enterprise

• Added support for configuring authentication using a Custom Identity Provider.

How to

• Added sample configurations files for enabling OAuth Authentication with Keycloak, Okta and Gitlab.
• Added procedure about how to configure Apache HTTP Server as reverse proxy for Oxygen Feedback.

Security

• Fixed SONATYPE-2020-1438 vulnerability issue by removing the dependency of the jakarta.el library, as it was not being used by Oxygen Feedback.