3.132.6-beta.0 (2026-09-15)
Bug Fixes
- admin: limit events, archives and event records to what each role may act on (#1483) (e5157ba)
- backend: enforce single-use and cap limits under concurrent requests (#1486) (8db8b8e)
- backup: pin every restore download from S3 to the validated endpoint address (#1477) (8ec559f)
- backup: verify restore dumps, bound imports and keep secrets apart (#1491) (9f0e815)
- backup: write the database dump where the backend can reach it (#1502) (acdced6)
- email: keep mail passwords and account links out of reach of other servers and readers (#1485) (89beb01)
- frontend: keep custom head HTML out of the admin UI, drop dead feedback limits (#1489) (c95d207)
- gallery: end gallery sessions when their password, portal session or admin idle time ends (#1497) (4791c88)
- gallery: enforce category downloads, hidden-photo feedback and photo caps for guests (#1495) (dfc8ade)
- permissions: keep SSO role mappings, backup destinations and restores within the actor's own power (#1493) (8c9d933)
- uploads: serve and accept only image files from the public logo trees (#1478) (3a7a85c)