v3.46.13

3.46.13 (2026-09-11)

Bug Fixes

• admin: keep header-style tiles from overflowing their cards (stable) (#1423) (82b412f)
• backend: bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375) (024ffed)
• backend: check the revocation store on gallery access (stable) (#1388) (b869de3)
• backend: contain and sanitize the SQLite restore source path (#1393) (b663f2a)
• backend: enforce event ownership on short URL deletion (#1394) (1abd42e)
• backend: reject a replayed TOTP code within its validity window (stable) (#1398) (33d6904)
• backend: require actor to hold every permission of a role they grant (stable) (#1380) (050eaf6)
• backend: shorten payment-check token TTL and notify admin on use (#1392) (b2ae7f1)
• backend: use the strong password generator for resets and enforce must_change_password (#1396) (167755f)
• backend: validate business-profile logo uploads by content, not filename (stable) (#1395) (00a5c3a)
• backend: validate event id before using it in the logo storage filename (stable) (#1397) (5f03d5a)
• backend: validate the S3 endpoint host before the restore download (stable) (#1391) (c008f43)
• gallery: bound and reclaim storage reads in the guest download routes (stable) (#1416) (a5e797e)
• gallery: bound the cached-zip builder's reads and cap rebuild concurrency (stable) (#1421) (222b144)
• gallery: keep videos playable under enhanced and maximum protection (stable) (#1408) (0732a16)
• gallery: let an admin preview a draft through its short share URL (stable) (#1407) (7382e13)