This release includes a targeted security update to address GHSA-pq4g-8rxf-4g29. Updating this dependency helps reduce exposure to a known vulnerability and keeps the app safer for everyone.

This release updates the ZIP export component to address CVE-2026-85396. Users benefit from stronger protection when generating ZIP files for exports, with no changes required to how exports are used.

Form submissions that declare an ASCII-incompatible charset (such as UTF-16 or UTF-32) no longer trigger unexpected server errors. These requests are now safely rejected with a 400 response, helping prevent anonymous scanners from causing hard-to-diagnose 500s during request parsing.

Requests that included a forged Client-IP header could trigger an unhandled error and return a plain 500 response, bypassing normal protections. This release drops that untrusted header so requests are handled normally, keeping error responses consistent and reducing noisy, unauthenticated failures.

This release tightens security around exports and sign-in flows, and fixes a session expiry mismatch that could log you out earlier than expected. It also makes the changelog API more consistent by returning the correct public URLs and resolving projects by the same repo identifier used in links.

This release patches a security issue affecting Active Storage variant processing and strengthens GitHub webhook handling during reinstall scenarios. Public endpoints now resolve owner and repo slugs even when URL casing differs, and private repositories added via webhook default to drafts to avoid accidental publishing.