ellite/Wallos v5.5.0 on GitHub

5.5.0 (2026-09-01)

let admins allow standard users to use the Webhook Allowlist (closes #1153, closes #1138) (41494ef)

auth: actually delete the login token on logout (#1184) (41494ef)
auth: make the TOTP replay guard run (#1181) (41494ef)
close remaining gaps in login-token revocation from #1184's review (41494ef)
OIDC token exchange failing behind CDN/anycast proxies (closes #1145) (41494ef)
payment method in-use guard misses when 2+ subscriptions share it (closes #1179) (41494ef)
reflected XSS via unescaped theme cookies in inline scripts (41494ef)
reject deleting or disabling an in-use payment method on every path (41494ef)
undefined array key warnings for subscriptions with no seeded stats bucket (closes #1182) (41494ef)