drakkan/sftpgo v2.7.6 on GitHub

WebDAV: return the correct ETag after an upload, or no ETag when it is unavailable.
An instance that starts with an empty admins table kept serving the setup page until restart; instances backed by a shared SQL provider now re-check the database.
OIDC: bound the authorization request to the user agent.

Share links were not revoked when the owning account was disabled or expired. GHSA-5jhj-cjcp-jr8r.
Unbounded memory allocation when parsing SCP protocol records. GHSA-j4w8-6gjf-fqvg.
WebClient: Stored cross-site scripting through directory names. Reported by ERNW. GHSA-f9qc-3v4f-32w3.
File pattern filters were not evaluated on the source of a copy. GHSA-wwv9-g5x4-966q.

Downloading a share restricted to a single directory as a ZIP archive could extend the share to the owner's entire file system; this affects only the in-memory data provider, while other data providers are not impacted. Thanks to Yutaka Sasaki (@SAYUTIM) for the report.
SFTP: computing a file hash reads the whole file and now requires the download permission; it previously accepted list. Reported by @cyny666.
Self-service changes to a password, profile or two-factor settings wrote the whole account back and could overwrite a concurrent administrator change. They are now conditional on the stored updated_at. Thanks to Thomas Toth for the report.
httpd: JWT invalidation is now keyed on the token ID. Invalidation was keyed on the exact token text, so an equivalent Base64URL spelling of the same signed token did not match the stored entry and kept working after a logout. Reported by Corban Villa (@corbanvilla), Sohee Kim (@soh3e) and Austin Chu (@dderpym).
Packaging: harden the data directory permissions on install; warn at startup when running with an effective uid of 0.