3.46.9 (2026-09-03)
Bug Fixes
- security: batch 1 (stable) — zxcvbn DoS, revocation forgery, unlink traversals, stored Content-Type, edge middleware (3f90221)
- security: bound password input before zxcvbn, and drop the legacy media mounts (ed08ff8)
- security: close three middleware gaps around the API edge (b136906)
- security: contain logo, favicon and PDF-logo unlinks to their upload directories (882101b)
- security: enforce the strength-endpoint validators, and stop the generator spinning (706d402)
- security: harden four smaller gallery and contract paths, drop the unmounted photo auth middleware (d81cade)
- security: never serve a photo under its stored MIME, and stop trusting the chunked-upload type (a8d57f0)
- security: stop reflecting submitted passwords in validation errors (6481708)
- security: stop reflecting submitted values in validation errors everywhere, cap credential lengths, close the login timing oracle (406c638)
- security: verify the signature before writing a token to the revocation list (c6d4016)
Documentation
- say the upload allow-list covers every path, video extensions must be added (c89ce8e)