Ergo 2.19.1 fixes three security holes — update your IRC server now

Ergo shipped 2.19.1 on 5 August, and the project's own wording is unusually direct: a release "addressing recently reported security vulnerabilities, some of which are serious", with all affected deployments urged to upgrade as soon as possible.

Three advisories, everything up to and including 2.19.0 affected:

• Account verification and suspension bypass (high) — users could get around email verification or an account suspension through alternative authentication methods. If you suspended someone, they may not have stayed suspended. GHSA-x6wg-9hcg-fc9v
• Authorization bypass on message deletion (high) — the permission checks on user-initiated deletion, including REDACT, were wrong, so people could remove messages that were not theirs. GHSA-8cmp-fc56-7g44
• Blind SSRF via web push (medium) — the web push notification path could be pointed at internal addresses. GHSA-7pw8-m2w2-f545

The two high-severity ones are moderation bugs, which makes them worse than they first look. A network that relies on suspensions to keep someone out has been relying on a control that could be walked around.

Nothing changes in the config or database format, so this is a drop-in upgrade — no migration, no editing ircd.yaml. That removes the usual excuse for putting it off.

Update: ergo.chat/downloads, or your package manager. Full notes in the 2.19.1 release.

Ergo 2.19.0, two weeks earlier, was the feature release — and it carries a compatibility break in the extjwt block, so if you are jumping from 2.18 read its notes before you upgrade rather than after.