v1.51.2

This release fixes three security issues in how access is checked and corrects the cost per kilometre shown on trips reported by Home Assistant. Updating is recommended.

Bug fixes

• Trip costs: tires, maintenance and insurance are now spread over the distance actually covered according to the odometer, not only over the recorded drives, so trips reported by Home Assistant no longer show absurd per-km costs. (#791)
• Security: an access token is now refused on every route once its session has been revoked ("sign out everywhere", expired session), instead of staying valid until it expires. API tokens are not affected. (#796)
• Security: a vehicle's creator who was removed from it or demoted no longer keeps owner access to the vehicle and its documents; access follows the current members only. (#794)
• Security: read-only members no longer see the reminder webhook URL, which can contain a secret. Owners who shared a vehicle with viewers while a webhook was set may want to rotate that URL. (#795)

Documentation

• The security advisory workflow is described in the contributor notes. (#793)

Maintenance

• Built with Go 1.26.10 to pick up a standard library security fix. (#792)

Full Changelog: v1.51.1...v1.51.2