Are these recent changes security patches?

[lindsay-stevens]

0.40.8 and 0.41.7 includes these two "bug" fixes:

Disallow FDW connections in SQLite

Remove _internal routes

And 0.42.4 includes this "enhancement":

Fix conditional logic in geojson api endpoint

But they look like they might be security fixes. The links in the PRs for more context are inaccessible since they refer to private GitHub repositories. There aren't any new security advisories on the main Metabase repo since Dec-2021.

Please let the community know what these are about so we can assess how urgently to upgrade or mitigate.

Thanks!

[flamber]

Hi @lindsay-stevens
Advisories has been updated: https://github.com/metabase/metabase/security/advisories