What's Changed
- fix(security): add UI Content-Security-Policy (GHSA-626p-c2xw-r7pg) by @adubovikov in #960
- fix(security): block OAuth avatar SSRF (GHSA-h4qr-v7ch-q758) by @adubovikov in #961
- fix(security): stop storing session JWT in localStorage (GHSA-rqwc-fmx3-95j8) by @adubovikov in #962
- fix(ci): stop using unpinned polyfill-glibc-action:latest (GHSA-7567-57wg-qcvj) by @adubovikov in #963
- fix(packaging): pin SHA-256 of bundled DuckDB extensions (GHSA-vqh9-j3rh-cj62) by @adubovikov in #965
- fix(docker): non-root runtime and digest-pinned bases (GHSA-9c8w-qvmp-pvjj) by @adubovikov in #964
- fix(scripting): sandbox Lua VMs (GHSA-m726-p857-j3cc) by @adubovikov in #966
- fix(flightsql): validate SQL and require Grafana Bearer auth (GHSA-w9hq-83jw-w7h9) by @adubovikov in #967
- fix(auth): refuse default sipcapture admin password (GHSA-263f-5xrw-c34r) by @adubovikov in #968
- fix(auth): force password change after sipcapture login (GHSA-263f-5xrw-c34r) by @adubovikov in #970
Full Changelog: 11.0.325...11.0.326