3.122.7-beta.0 (2026-09-03)
Bug Fixes
- security: batch 1 — zxcvbn DoS, revocation forgery, unlink traversals, stored Content-Type, edge middleware (ea394b5)
- security: bound password input before zxcvbn, and drop the legacy media mounts (14cd5ea)
- security: chunked-upload init checks the size cap before the type allow-list (0ac006b)
- security: close four middleware gaps around the API edge (839bf4e)
- security: contain logo, favicon and PDF-logo unlinks to their upload directories (3e46530)
- security: enforce the strength-endpoint validators, and stop the generator spinning (054cd6f)
- security: harden four smaller gallery and contract paths, drop the unmounted photo auth middleware (835312e)
- security: never serve a photo under its stored MIME, and stop trusting the chunked-upload type (063977d)
- security: stop reflecting submitted passwords in validation errors (903e471)
- security: stop reflecting submitted values in validation errors everywhere, cap credential lengths, close the login timing oracle (40a8a98)
- security: verify the signature before writing a token to the revocation list (0ca0e4a)