3.134.7 (2026-10-16)
Bug Fixes
- ci: pass release-please outputs to the summary step as env (#2101) (59df71f)
- downloads: count nothing on a HEAD probe (#2149) (b43aa40)
- gallery: do not cache the hero and preview fallback redirect (#2148) (0988041)
- gallery: serve still images at enhanced and maximum protection instead of a dead token bounce (stable) (#2150) (48802a0)
- media: strip EXIF and GPS from derived images (#2081) (daad077)
- security: count an IPv6 /64 as one client in the stable rate limiters (#2103) (6773366)
- security: derive the rate-limit client IP from the trusted proxy hop (#2083) (8211c5b)
- security: send uploaded SVGs with a strict CSP and trim /health (stable) (#2160) (5e8be22)
- security: stop keeping gallery passwords in the mail queue (stable) (#2162) (b8d84f0)
- security: trust no proxy hop by default in the all-in-one image (#2105) (a92a468)
- upload: validate file content on guest and chunked uploads (#2085) (cd513c7)