3.167.2-beta.0 (2026-10-08)
Bug Fixes
- analytics: isolate telemetry from application credentials (#1856) (98019bf)
- auth: harden client links and transfer upload codes (#1845) (bfef9e7)
- auth: protect account recovery secrets at rest (#1848) (42f4ad1)
- backup: authenticate standard recovery manifests (#1865) (d458c3c)
- backup: pin rsync SSH destinations and require approved host keys (#1868) (ccaf88c)
- db: verify PostgreSQL TLS across pools and native clients (#1852) (706711d)
- enforce gallery original-asset authorization (#1878) (13171bb)
- mail: bind SMTP and IMAP connections to vetted DNS answers (#1872) (1137d21)
- mail: bound retained intake bytes and lifecycle (#1888) (7979157)
- scope external media sources to their owners (#1880) (7d88c98)
- security: tighten production network and cookie defaults (#1850) (6fe8c94)
- workflows: enforce owner scope on execution data (#1843) (b10e817)