·
96 commits
to 34b195c5b8778c65cdf474999bf77c1ec72144dd
since this release
This beta strengthens first-run setup, browser compatibility, ticket privacy, uploads, notifications, integrations, and the packaged Docker runtime.
Highlights
- Made first-run setup tokens reliably one-time under concurrent requests and improved safe recovery after interrupted setup.
- Fixed ticket creation and copy actions on private-LAN HTTP deployments where secure-context browser APIs are unavailable.
- Prevented restricted ticket-form fields from appearing in API responses or editable requester payloads.
- Revalidated notification recipients at delivery time and removed deleted-comment content from notifications.
- Bounded upload request bodies even when clients omit or misreport
Content-Length. - Hardened API authentication throttling, reverse-proxy address handling, and webhook retry signing.
- Corrected Docker image packaging and migration execution, and refreshed deployment and recovery guidance.
- Updated dependencies; both production and full npm audits report zero known vulnerabilities at release time.
Beta limitations
- Docker Compose with bundled PostgreSQL is the supported deployment path for this beta.
- Multi-replica deployments require shared attachment storage and coordinated configuration.
- Malware scanning requires an optional ClamAV service.
- SMTP server acceptance does not guarantee mailbox delivery.
Back up the database, configuration, and attachment storage before upgrading. See the README and deployment guides for the supported installation and update procedure.