• changed telegram API endpoints to require admin privileges (feature might be removed in the future)
• fixed it was not possible to clear select fields in some cases
• fixed space members with a valid share link for a private recipe in their own space could change/delete that recipe GHSA-284w-8f8v-4fvv
• fixed meal plan and sub recipe api views could leak info of private recipes to other space members GHSA-fjqg-7q3w-h7x5
• fixed ability to update AI providers trough the space API GHSA-qvcj-c877-39jm
• fixed ability to update serveral models trough nested API endpoints GHSA-mhp5-f6m6-66qx
• fixed mealplan or bookmarklet tokens (created automatically by the importer) could create a space GHSA-39h5-jv66-84p5
• fixed mealplan or bookmarklet tokens could update shopping list entries trough bulk endpoints GHSA-p6v2-4p2w-464j
• changed generated export files can only be downloaded by the user who created the export GHSA-3jj6-2crq-r7gv
• fixed shared users in private recipes could unprivate/change the share list of that recipe trough the bulk updater GHSA-4crj-r7q3-qxhw
• fixed ingredients submitted to the /recipe//shopping endpoint could belong to other recipes from the same space the user did not have access to
• changed import logs to only be visible to the user who created them so recipe names that are later made private do not show in the log GHSA-c34j-hcg4-386m
• fixed malicious filenames in a nextcloud cookbook export could hang the importer GHSA-p93c-6m6f-h588
• fixed malicious zips could hang the paprika importer GHSA-7gg4-cm2v-2p42