What's Changed
- Chore: Sync Sonarr 2026-10 (auth batch) (#965) (8a793b2) - @plz12345
- Chore: Disposition Sonarr 2026-10 auth batch (741d8a3) - @plz12345
- Fix: Use constant-time comparison for API key and password hashes (41834b5) - @plz12345
- Fix: Stop granting Everyone write access to the AppData folder on Windows (238f42c) - @plz12345
- New: Enable Forms authentication by default (5eefbe6) - @plz12345
- Fix: Reload the browser after resetting the API key, not restart (5ad1cef) - @plz12345
- Fix: Path validation rejects relative path segments (c228fd2) - @plz12345
- Fix: Don't return passwords and secrets from the host config API (c8ba7db) - @plz12345
- New: Lockout after failed login attempts (b64207d) - @plz12345
- Fix: Raise password hash iterations to the OWASP recommendation (f92ed9a) - @plz12345