3.98.2-beta.0 (2026-08-01)
Bug Fixes
- security: block guest access to hidden/client-only photos across bulk + secure routes (#939) (8a87c92)
- security: bump sanitize-html to 2.17.5 (CVE-2026-53606) (#937) (fe615c8)
- security: close authorization/ownership gaps (token scope, mass-assignment, category hero, project docs) (#943) (82d6871)
- security: resolve DNS before vetting external hostnames (SSRF cluster) (#941) (b700569)