• fixed command injection with custom link actions (@r3vpwnx, @Afnaan-Ahmed #2945 CVE-2026-118692)
• fixed arbitrary local file read via crafted embedded-file name (@Afnaan-Ahmed, #2944 CVE-2026-118693)
• reject symlinked multifile node directories + prevent cleanup from following symlinks (@acts-1631, #2922, #2920)
• reject empty tables during XML parsing so malformed XML cannot reach table construction or clipboard indexing (@acts-1631, #2923)
• on node name header, show node icon and aux icons on the left rather than on the right, just after last visited nodes buttons
• improved image download on HTML paste from browser (#2925)
• fixed crash when destroying anchored widgets (#2947)
• support for new language Tamil (@TamilNeram)
• build with libxml++5 on windows/msys2, ubuntu 26.04+, flatpak (#2918, @bgermann)