Requests that included a forged Client-IP header could trigger an unhandled error and return a plain 500 response, bypassing normal protections. This release drops that untrusted header so requests are handled normally, keeping error responses consistent and reducing noisy, unauthenticated failures.

This release tightens security around exports and sign-in flows, and fixes a session expiry mismatch that could log you out earlier than expected. It also makes the changelog API more consistent by returning the correct public URLs and resolving projects by the same repo identifier used in links.

This release patches a security issue affecting Active Storage variant processing and strengthens GitHub webhook handling during reinstall scenarios. Public endpoints now resolve owner and repo slugs even when URL casing differs, and private repositories added via webhook default to drafts to avoid accidental publishing.

Suspended GitHub App installations are now treated as an expected state, so affected installations and projects are marked inaccessible and disabled without generating noisy error reports. This release also includes security fixes for known dependency advisories, reducing risk in areas that process and sanitize user-facing content.

This release updates several underlying components in response to security advisories. You do not need to take any action, but you should benefit from a safer, more secure experience through updated third party libraries.

This release tightens several security-sensitive flows, including custom template rendering, webhook validation, and redirect handling. It also fixes edge cases around repository slugs and makes background processing more resilient, so updates and notifications are less likely to fail unexpectedly.