This release focuses on protecting common workflows and reducing surprises in day-to-day use. You should see more consistent sessions, safer exports, and cleaner API responses.
Security and safety updates
Exports are now protected against unsafe image fetching. If an entry contains image URLs that point somewhere they should not, exports will no longer pull that content into your downloadable archive.
Starting checkout from a direct page load is now safer. Visiting the checkout page no longer triggers a purchase session creation by itself, which helps prevent unwanted checkout sessions from being initiated via cross-site requests.
Team invitation acceptance during sign-in now enforces the same email checks as the dedicated invite flow. This helps ensure an invite can only be accepted by the account it was intended for.
Custom template previews now re-check repository access before showing real entries. This prevents previews from rendering content from repositories you do not have access to.
Fixes and consistency
Sessions now expire more reliably. A mismatch between the app’s intended session length and the underlying session storage expiry could end sessions earlier than expected, this is now aligned so you stay signed in for the expected duration.
The changelog API now returns more consistent project identifiers and public URLs. It can resolve projects using the same repo identifier used in public links, and entry responses now include the correct public URL format.
Unique visitor counting is now more reliable under concurrent traffic. This reduces the chance of double-counting or missing a visit due to timing issues.