This release patches a security issue affecting Active Storage variant processing and strengthens GitHub webhook handling during reinstall scenarios. Public endpoints now resolve owner and repo slugs even when URL casing differs, and private repositories added via webhook default to drafts to avoid accidental publishing.

This release fixes two GitHub-related issues that could block onboarding. Signups no longer fail when GitHub does not provide an email address, and GitHub App install updates no longer break when a single repository in the payload cannot be processed, helping ensure the rest of your repos still get connected.

Suspended GitHub App installations are now treated as an expected state, so affected installations and projects are marked inaccessible and disabled without generating noisy error reports. This release also includes security fixes for known dependency advisories, reducing risk in areas that process and sanitize user-facing content.

If a connected GitHub App installation has been removed, sync and repository fetching now treat it as no longer accessible instead of failing unexpectedly. This helps keep your connected projects in a consistent state by automatically disabling access when GitHub reports the installation is gone.

This release tightens several security-sensitive flows, including custom template rendering, webhook validation, and redirect handling. It also fixes edge cases around repository slugs and makes background processing more resilient, so updates and notifications are less likely to fail unexpectedly.

This release updates Redis-backed caching and request throttling to stay compatible with recent library changes that introduced breaking behavior. The result is a more reliable setup for background jobs and Redis-based features, without needing special workarounds in production.