Breaking
- security: protect cookie authentication against CSRF by @david-loe in #653
What's Changed
- fix: restore admin user management by @david-loe in #647
- fix: validate advance ownership in all report APIs by @david-loe in #649
- fix: prevent prototype pollution in CSV imports by @david-loe in #650
- test: specify billing behavior through black-box examples by @david-loe in #648
- fix: enforce project scope for report creation and reassignment by @david-loe in #651
- fix: authorize document references independently of uploads by @david-loe in #652
- fix: validate getter filters against response projections by @david-loe in #654
- fix: protect historical reports from operational writes by @david-loe in #655
Full Changelog: v3.0.3...v3.1.0