SummitPSA 0.3.2 — Security & maintenance update

SummitPSA 0.3.2 is a security and maintenance release. Its headline is a simple, honest one: as of this release, every known security advisory in the third-party components SummitPSA bundles has been resolved, with no exceptions carried forward. Where our previous release noted a small number of advisories held for a planned framework update, this is that update, and it closes them out completely rather than deferring anything.

Most of what follows is invisible in day-to-day use. The one new capability you can act on, requiring two-factor authentication across your team, has its own section below.

A clean security baseline

• Every tracked advisory resolved, with zero exceptions. We updated the underlying web framework to a current, fully-supported release and brought every bundled component up to a patched version. Our release process now passes its dependency-security check with an empty exception list: nothing is waved through, and nothing is carried forward to “later.”
• Hardened error handling and rate limiting. Protective response headers now apply consistently even on unexpected errors, and more sensitive endpoints, including client feedback and survey links, are rate-limited against abuse.
• Improved input validation across document generation and other content-handling paths, further reducing the chance that untrusted content can affect output.
• Improved handling of inbound email replies, so that replies are matched to the correct ticket more reliably.

New: require two-factor authentication across your team

SummitPSA has always let you require two-factor authentication (2FA) for an individual agent. 0.3.2 adds an organization-wide policy, with a gentle, two-step rollout designed so no one is ever caught off guard:

• Notify. Agents who haven’t set up 2FA yet see a friendly reminder to do so, but are never blocked from working. Use this as a grace period.
• Enforce. When you’re ready, turn this on and 2FA becomes required at sign-in. Agents set it up themselves the next time they log in, so there is no lockout, and no administrator has to enroll anyone.

You can turn it on, and move between Notify and Enforce, under Settings → Login security. The choice is fully reversible at any time. Individual per-agent requirements still work alongside the organization-wide setting, and non-interactive service accounts are exempt from the team-wide requirement so your automations keep running.

If your team handles client data, turning this on is one of the highest-value security steps you can take. We recommend starting in Notify for a week or two, then moving to Enforce.

Upgrading

0.3.2 is a standard, non-breaking upgrade with no database changes. The in-app updater installs the release by its verified digest; follow your normal upgrade steps and keep your previous version available as a rollback, as always.

Self-hosted operators: there is no new proxy configuration in this release. If you completed the one-time reverse-proxy check from 0.3.0 (forwarding X-Real-IP and X-Forwarded-Proto), you’re all set; if you haven’t, the Reverse-proxy reference shipped with your install still has the copy-and-paste configuration.

Questions about your upgrade, or about rolling out two-factor authentication to your team? Reach out through your usual SummitPSA support channel. We’re happy to help.