Please update as soon as possible. This security and maintenance release fixes a high-severity password-reset link vulnerability that can allow account takeover in affected configurations: GHSA-75xw-v7vm-5v6r. Thanks to @orshih6 for responsibly reporting it.
- Optional
ALTERO_SSO_ONLYbrowser sign-in and provider confirmation for sensitive actions; desktop sync continues to use API keys. - Fixes for Zotero sync, OIDC issuer handling and SQLite connection cleanup.
- Browser editing, touch, accessibility and translation improvements.
Before upgrading an SMTP-enabled instance, configure ALTERO_PUBLIC_URL. Back up the database and attachments; upgrading from beta.7 includes database migrations. Follow the upgrade instructions.