Changes

• fix(security): block SSRF from the workflow engine (GHSA-v5xh-rw9h-77fv)
  • PR: #3118
• fix(files): make File.isPublic a real boolean so access gates work
  • PR: #3119
• fix: resolve QueryFailedError in api
  • PR: #3123
• fix(security): stop serving user-supplied Content-Type on file responses
  • PR: #3120
• fix: resolve QueryFailedError in api
  • PR: #3124
• fix(security): close the 10 remaining SSRF sinks outside the workflow engine
  • PR: #3128
• fix(teams): stop guessing the project for a tenant, and preflight channel installs
  • PR: #3129
• feat(terraform): make OpenTofu support explicit and tested
  • PR: #3127
• feat(monitor): alert dependency — suppress downstream alerts when a parent monitor is offline
  • PR: #3122
• fix(status-page): stop detail pages from loading forever when the item is missing
  • PR: #3130
• fix(helm): stop generating secrets that externalSecrets already provides
  • PR: #3126
• feat(project): record deleted projects so we can ask customers why they left
  • PR: #3135
• fix(runner): stop the code-fix harness leaking its GitHub token, mangling paths, and mislabelling failures
  • PR: #3142
• fix(criteria): keep the attribute filter row when its Number value is cleared
  • PR: #3148
• fix(ui): make the label colour field fillable, and stop the modal eating the form (#3143)
  • PR: #3150
• fix(dashboard): show every monitor type's step config on the criteria page
  • PR: #3149
• fix(kubernetes-agent): default eBPF context propagation to off
  • PR: #3151
• feat(workflow): show broken settings in the builder instead of at run time
  • PR: #3158
• fix(kubernetes-agent): repair split options table and correct the kernel claim
  • PR: #3156
• feat(topology): draw routers, switches, firewalls and hosts as distinct shapes
  • PR: #3154
• fix(ui): open a real modal for "Custom Range" in the time range picker
  • PR: #3147
• docs: restore Cons label eaten by a regex backreference in 14 locales
  • PR: #3152
• Draw state and province lines on the Network Map when zoomed in
  • PR: #3155
• feat(api): accept the master API key on the user-projects read
  • PR: #3153
• feat(entities): manual CIs and inventory coverage in the entity registry
  • PR: #3157
• feat(workflow): record what each step of a run did, and show it
  • PR: #3160
• feat(workflow): row editors for database arguments, and run feedback
  • PR: #3159
• feat(workflow): run just this step, from the builder
  • PR: #3161
• feat(workflow): start from a template
  • PR: #3162
• fix(dashboard): restore topology metadata for the new entity types
  • PR: #3163