3.122.3-beta.0 (2026-09-02)
Bug Fixes
- accounting: allow creating a customer from the picker (be39929)
- accounting: let "bill to a customer" work with the portal off (3790156)
- admin: interpolate activity and notification message values (78b1ddd)
- admin: portal the update-available modal to document.body (ac50f0b)
- analytics: serve self-hosted trackers same-origin so CSP stops blocking (3468550)
- analytics: warn about the CSP allowlist on every tracker provider (3489610)
- archives: run search, filter and sort server-side (fc7cb22)
- archives: sort and total on real archive sizes, escape LIKE wildcards (da6e34d)
- calendar: don't put a fixed reference date in the month header (76a1453)
- categories: validate category name length instead of 500ing (5fa04e6)
- close the remaining 2026-09-01 QA items, warnings and follow-on defects (cad699a)
- contracts: add tooltips to the ellipsized block-library names (d16137b)
- contracts: widen the block-library list column (bd44708)
- email: derive preview sample data from each template's variables (1be2740)
- email: give every template a real display name in the config UI (355fe4f)
- email: give gallery_created a real German translation (73b08a7)
- email: repair and seed the gallery lifecycle templates (41e1de7)
- events: add archive_size to the immutable column deny-set (57dd084)
- events: guard create-event submit against re-entrant submissions (c19e944)
- events: honour ?tab=, show a load error, and stop lying about uploads (504a8b6)
- events: rename a shadowing local and bound the photo-cap input (758dc00)
- events: render a not-found state instead of hanging on a 404 (c2428aa)
- events: return 409 instead of 500 when a slug is taken (afc5779)
- feedback: align word-filter severity vocabulary with the admin UI (6f7aa59)
- feedback: make the "block" severity tier actually reject (814f205)
- gallery: no-store private JSON, and give guest uploads a real status (a28f96b)
- gallery: restore the download CTA under headerStyle "none" (4c6ca49)
- gallery: show a guest's own upload without a hard reload (18715b5)
- gallery: stop browser zoom tripping the devtools viewport heuristic (72894e2)
- gallery: stop devtools protection from breaking the whole page (9d4bd7a)
- i18n: make i18n:ci pass by fixing the extractor config (5dbb435)
- middleware: log ownership lookup failures; drop dead auth surface (42ba835)
- migrations: judge each German field on its own in migration 195 (4515632)
- per-field template guard, LIKE escaping, wait for all uploads (da8fcc8)
- photos: emit visibility and processing_status from the list mapper (fe5ac91)
- photos: treat category_id 0 as uncategorized instead of storing it (3f6c81a)
- quotes: enforce the status state machine, and correct the table (103863c)
- resolve the 2026-09-01 QA run findings (#1-#21) and repo-health debt (9b63399)
- search: match the original filename, and honour the date-format setting (15fdd70)
- search: stop escapeLikePattern corrupting bound search values (a89057d)
- security: actually apply the general API rate limiter (b0f33c1)
- security: apply per-IP rate limiting to credential endpoints (50e8ed6)
- security: close the case-sensitivity bypass in the API rate limiter (a929aff)
- security: raise the general limiter's fallback budget to 300 (19e125d)
- security: rate-limit the password-change endpoints per IP too (5a0c9f5)
- settings: clear the accounting flag when its parent is turned off (3e16b81)
- settings: derive the sidebar preview from the real sidebar declaration (c6cb018)
- settings: don't crash on a fresh load before permissions resolve (673f055)
- settings: remove the duplicated section heading on 11 tabs (3acb452)
- types: resolve the TypeScript build:check backlog (6e5755d)
- ui: drop themed text colours from the last three admin surfaces (22cada9)
- ui: stop branding-theme text colour rendering headings invisible (da9ceb1)
- upload: enforce the chunked-upload cap on bytes received, not declared (77b11ab)
- upload: enforce the configured per-file size limit on admin uploads (e18ab0d)
- upload: scope category ids, stop temp-file leaks, split the video cap (7c9baff)
- users: give the cancel-invitation dialog a distinct confirm label (31ffbc8)
- webhooks: write delivery timestamps as ISO strings (c5c5a6b)
- workflows: restore the once-per-process seed guard (a7d45dd)
Documentation
- analytics: state the tracker proxy's trust model (23a433f)