v1.0.2

Security Hardening

This release adds no new features. It fixes the findings of a security audit and moves the project to the app-torq organization.

Security

• Login throttling: failed logins for a username are now throttled per client IP, so nobody can lock another user out from everywhere. A global per-username limit still applies after 50 failures. A successful login no longer resets the failure count of its IP.
• Password hashing: concurrent argon2id runs are capped at the CPU count, so a burst of login requests can no longer exhaust memory. Usernames over 32 bytes and passwords over 1024 bytes are rejected before hashing.
• CSV export: text cells that a spreadsheet would run as a formula (starting with =, +, -, @) are now prefixed with '.

Other changes

• The repository moved to app-torq/torq. The container image is now ghcr.io/app-torq/torq; please update your docker-compose.yml.
• CI actions are pinned to commit SHAs, and Dependabot keeps dependencies up to date.