v4.16.6

Release build (patch) of NodeBB @ 2026-10-30T20:48:55.185Z

v4.16.6 (2026-10-30)

Bug Fixes

• dont allow redirect to unsafe url via /ap?resource path (373f3f3)
• auth:
  • prevent user account enumeration (via email) on login (ce1c358)
  • ignore client-supplied uid in registration flow (376d14a)

Tests

• on more corepack test (b121082)
• dockerfile change for corepack, its removed in node:lts (db611d0)
• fix relative_path tests (435d718)
• remove .only (8df05a3)