Bug Fixes:
-
remove deprecated page_from_params/3 (client-controlled count) by @zachdaniel
-
don't leak submitted params in unknown _union_type error (CVE-2026-82727) by @zachdaniel
-
match root host case-insensitively and as an exact suffix in get_subdomain (CVE-2026-82726) by @zachdaniel
-
reject filtering across non-public relationships in FilterForm (CVE-2026-82725) by @zachdaniel
-
run handle_subdomain with the real tenant in handle_params (cross-tenant) (CVE-2026-82724) by @zachdaniel
-
propagate actor, scope and tenant to a single nested form built from existing data (#483) by Johannes Welebil (#483)
-
don't use
negated?for filter generation by @zachdaniel -
prevent false PendingCodegen when the check races the code reloader (#482) by @Malian (#482)
-
resolve actor and tenant from scope before building nested forms (#480) by @Valian (#480)