What's Changed
- fix: stop serving private user assets via unauthenticated nginx static route by @gantoine in #3480
- Expose per-device save sync attribution and origin device by @tmgast in #3479
- feat(playmatch): add ratelimiting by @DevYukine in #3482
- Fix Docker volume mounts to enable hardlink optimization by @gantoine in #3484
- Handle malformed Authorization headers in HybridAuthBackend without 500s by @gantoine in #3489
- Add rate limiting to metadata service API requests by @gantoine in #3485
- Add opt-in files/siblings expansion to GET /api/roms by @tmgast in #3490
- Handle missing console bezel assets without rendering Safari broken-image overlay by @gantoine in #3494
- Fix smart collection status filter normalization for multi-value legacy payloads by @gantoine in #3495
Full Changelog: 4.9.0-beta.1...4.9.0-beta.2