v3.46.9

3.46.9 (2026-09-03)

Bug Fixes

• security: batch 1 (stable) — zxcvbn DoS, revocation forgery, unlink traversals, stored Content-Type, edge middleware (3f90221)
• security: bound password input before zxcvbn, and drop the legacy media mounts (ed08ff8)
• security: close three middleware gaps around the API edge (b136906)
• security: contain logo, favicon and PDF-logo unlinks to their upload directories (882101b)
• security: enforce the strength-endpoint validators, and stop the generator spinning (706d402)
• security: harden four smaller gallery and contract paths, drop the unmounted photo auth middleware (d81cade)
• security: never serve a photo under its stored MIME, and stop trusting the chunked-upload type (a8d57f0)
• security: stop reflecting submitted passwords in validation errors (6481708)
• security: stop reflecting submitted values in validation errors everywhere, cap credential lengths, close the login timing oracle (406c638)
• security: verify the signature before writing a token to the revocation list (c6d4016)

Documentation

• say the upload allow-list covers every path, video extensions must be added (c89ce8e)