backend: v0.23.0

0.23.0 (2026-09-22)

Features

• add frontend telemetry relay endpoint for product analytics (a6ab2ea)
• add frontend telemetry relay endpoint for product analytics (4e36dd6)
• add in-memory fallback for sessionStorage to prevent blank page in private browsing (e1fa9a0)
• add per-event attribute count and key length limits to prevent log bloat (e77f17c)
• add periodic sweep to prevent unbounded memory growth in rate limit buckets (76934f3)
• add session ID length limit and rate bucket cardinality cap to prevent memory exhaustion (4cc5382)
• prevent duplicate session.started events across page reloads (f7ea9e9)

Bug Fixes

• prevent client forgery of server-owned telemetry provenance fields (081088e)
• prioritize in-memory store in safeGetItem to prevent ID churn when sessionStorage writes fail (f4abd16)
• remove /api prefix from telemetry endpoint route (803197b)
• reserve overflow bucket slot to prevent rate limiter map from exceeding _MAX_RATE_BUCKETS (7399759)
• return non-dict attributes unchanged in validator to prevent 500 on type mismatch (c83d10f)

Documentation

• document rate limit concurrency invariant and single-process safety assumptions (01bdef0)