Security Update
This release fixes vulnerabilities that allowed access to files in the .git directory via attachments, HTML injection via math code blocks and script execution via links in MathJax. We strongly recommend updating to this version as soon as possible.
Security Fixes
- Do not expose .git files as attachments (263cac4).
- Escape the content of math code blocks (b2e91d2).
- Block unsafe urls in MathJax links (28f9ae3).
Thanks to Zachariah Mithani for responsibly disclosing these issues and bringing them to our attention.
Bug Fixes
- Use package discovery and SPDX license in pyproject (d8f065b).