This release focuses on keeping your changelogs safe and accessible. It includes a security fix and several reliability updates around GitHub installs, webhooks, and public project URLs.
Security update
We addressed a security vulnerability in Active Storage variant processing that could be reachable in this app because variants are used for project logos and favicons. Updating closes the issue and keeps image processing safer.
Fixes for public URLs and GitHub webhooks
Public endpoints that use owner and repo slugs now work even if the URL casing does not match what GitHub uses. This helps prevent unexpected 404s on the public changelog, embeds, and subscription flows when someone shares a lowercase link.
We also fixed a GitHub installation_repositories webhook issue where a reinstall could leave old projects behind and cause new repository adds to fail. Each repository in the webhook payload is now handled independently so one problematic entry does not prevent the rest from being processed.
When a private repository is added via webhook, it now defaults to drafts (no auto-publishing). This reduces the risk of private repo changes being published without review.