What's Changed
- chore: refresh forge-kit governance assets and add the roadmap by @agigante80 in #267
- fix(dashboard): Dismiss button always returned 500 (#264) by @agigante80 in #269
- fix(sync): run syncs one at a time on the shared Actual API session (#265) by @agigante80 in #274
- fix(ci): pin trivy-action to a commit SHA (#248) by @agigante80 in #276
- fix(security): opt-in healthCheck.trustProxy for reverse proxies (#245) by @agigante80 in #277
- fix(#242): authenticate the /ws/logs handshake and check its Origin by @agigante80 in #279
- fix(#272): bound every Actual API call so a hung sync cannot block the queue by @agigante80 in #283
- fix(security): throttle failed dashboard logins per client IP (#246) by @agigante80 in #285
- test: browser E2E harness with shared fixture states (#263) by @agigante80 in #287
- release: P0 security and bug patch (v1.17.2) by @agigante80 in #290
Full Changelog: v1.17.1...v1.17.2