v0.6.1

Released: 2026-07-19

Changes since v0.6.0 (f0a90fc..merge of #119).

Security

Enforce CSRF on the upload endpoints (PR #119 by @gabrielforster, closes #118): The image, media, and AI upload actions no longer skip_forgery_protection — they now inherit the app-wide CSRF check like every other mutating request. With the editable S3 destination key from v0.6.0, a cross-site POST to a user's FrankMD (localhost / LAN / tunnel) could otherwise have passed an arbitrary s3_key and overwritten any object in the configured bucket. The seven affected actions are images#upload, images#upload_to_s3, images#upload_external_to_s3, images#upload_base64, media#upload, ai#fix_grammar, and ai#generate_image. No client change was needed: every in-app caller already posts through @rails/request.js, which attaches the token from csrf_meta_tags. A new test/controllers/upload_csrf_test.rb asserts each endpoint rejects a token-less POST with 422.