3.45.13 (2026-08-03)
Bug Fixes
- auth: fail closed when the adminAuth roles join errors (stable) (#975) (cc49f69)
- projects: stop the cockpit offering email controls the API rejects (stable) (#977) (2d0e6ab)
- security: backup/restore hardening — public-dir DB dump, restore path allowlist, gunzip bound, manifest keying (stable) (#962) (3b88036)
- security: bound inbound-mail resources, redact secrets from logs (stable) (#965) (ccab902)
- security: enforce event ownership on the v1 API surface (GHSA-9697) (stable) (#963) (4e99897)
- security: enforce project ownership on project + project-email routes (stable) (#966) (fecc18c)
- security: escape brand tokens, block tracker redirects, trim logo diagnostic (stable) (#967) (7f27e67)
- security: scope dashboard stats/analytics/activity to the caller's events (stable) (#964) (11f9f58)