3.142.1-beta.0 (2026-09-24)
Bug Fixes
- archives: read, restore and download event archives through the storage backend (#1659) (c606de3)
- auth: audit cleanup bundle: dead change-password route, single backup mount, stricter roles fallback, one replica (#1661) (4dfd463)
- backup: approvable internal S3 endpoints, a real connection test and honest backup status (#1642) (4634f09)
- backup: ask for the rsync SSH key file path, not the key (#1644) (dc7d5e6)
- backup: stop the form from moving a cron schedule, and mark the selected destination (#1643) (d2efcd1)
- docker: mount /backup in the production compose and let the entrypoint own it (#1664) (14c94cd)
- events: require at least six characters for a client password (#1666) (82ae07a)
- gallery: serve still images at enhanced and maximum protection instead of a dead token bounce (#1667) (87b4ef3)
- images: decide a resize is unneeded from the delivered orientation (#1645) (2c3f1b5)
- security: contain watermark and archive paths on read and on .picpeak import (#1660) (89b579f)
- security: pin rsync host keys, longer upload codes with a per-network lockout, constant-time image token compare (#1662) (599bf03)
- transfers: stream downloads through the error-handling helper (#1663) (e933fb3)