Release v5.18.2

• docs: bump version references to 5.18.2 (Dries Peeters)
• fix(security): harden OIDC fetch URL and API error responses (Dries Peeters)
• fix(security): centralize safe_redirect and close residual CodeQL sinks (Dries Peeters)
• fix(security): finish CodeQL security alert remediation (Dries Peeters)
• fix(security): clear CodeQL code-scanning findings (Dries Peeters)
• ci: add CodeQL workflow to resume code scanning (Dries Peeters)
• fix(security): harden DOM sinks and stop leaking bulk-delete errors (Dries Peeters)
• fix(security): vendor patched sprintf-js for Dependabot #222 (Dries Peeters)
• fix(docker): refresh base packages and upgrade pip/setuptools (Dries Peeters)
• fix(security): avoid DOM XSS from untrusted strings in UI JS (Dries Peeters)
• fix(security): harden PDF templates and stop leaking exceptions (Dries Peeters)
• fix(security): block open redirects via referrer and next params (Dries Peeters)
• fix: add CSP nonces to remaining inline scripts (Dries Peeters)
• fix: import db in timer review and idle-response handlers (Dries Peeters)

📦 Build Status

Desktop Applications

✅ Windows build: Success
✅ Linux build: Success
✅ macOS build: Success

Mobile Applications

✅ Android build: Success
✅ iOS build: Success