v1.6.1

Fixed

• 500 on a NUL byte in the URL — \x00 in a path or query parameter reached asyncpg and crashed with CharacterNotInRepertoireError (Postgres cannot store 0x00 in text). This affected every route passing a raw string into a WHERE clause. A new RejectNullBytesMiddleware now returns 400 before the request reaches any handler
• 500 on an invalid email in POST /api/v1/auth/send-link — the field was a bare str, so any string passed validation and reached Resend, which rejected it with its own ValidationError. The junk row had already been committed to verification_tokens by then. Added an Email type that strips, lowercases, and checks the format

Improved

• Cooldown on unhandled-exception alerts — 5 minutes per (exception type, method, route template). A single vulnerability scanner previously produced dozens of identical notifications; keying on the route template rather than the raw path collapses fuzzed path parameters into one alert