v0.7.5

0.7.5 (2026-11-08)

Features

• auth: throttle login attempts per account in addition to per IP (94cd451)
• console: add selftest command and load new commands lazily (b13f3dc)
• health: add unauthenticated /healthz endpoint (100e293)
• security: prune security bookkeeping and stop storing plaintext login IPs (a0348ae)
• ui: navigation state, home CTA and empty library state (3e3f1cf)
• ui: self-host Bootstrap Icons and share one layout head (bfeb96e)

Bug Fixes

• 2fa: keep TOTP codes as strings so codes with a leading zero verify (191bf50)
• a11y: accessible rating input, poster dialog and form labels (4a03feb)
• a11y: single token layer with AA contrast and one gold focus ring (e789f40)
• auth: revoke other sessions on the legacy settings password change (b7431d9)
• auth: store session tokens hashed only and revoke sessions on password change (2aa8c42)
• auth: treat sessions of users without 2FA as anonymous on the API (487e72d)
• csrf: protect admin settings API, state-changing GETs and the setup wizard (4ded64c)
• db: refuse to roll back the initial schema migration (79ffba2)
• deps: close 18 security advisories across 6 packages (9160e37)
• deps: update symfony/config and symfony/filesystem (4415ce2)
• docker: pin PHP 8.4.27 for CVE-2026-109618/-109619 (b897254)
• docker: pin PHP 8.4.27 for CVE-2026-109618/-109619 (10f690e)
• language: reject protocol-relative redirect targets after a language switch (2bc6108)
• login: let users without 2FA log in to enroll, make the login a real form (9bbb4d8)
• profile: clamp the security events limit to 1..100 (89fd2aa)
• rate-limit: declare the rate limit bucket per route instead of by path substring (23af18c)
• resolve findings of PHPStan 2.3 (6d6de38)
• review findings (auth, ops, frontend) and functional self-tests (36c88da)
• run composer audit against the lock file (1fea550)
• security: authenticate stored secrets and never replace an existing key (b22745d)
• security: derive client IP and https only from trusted server variables (121c9ee)
• security: render untrusted text without innerHTML (b42655f)
• settings: stop rendering the stored SMTP password into the page (b510a6e)
• ui: drop jsDelivr from the CSP and the removed login background script (58aaa20)
• users: validate admin user updates, keep the last admin, revoke sessions on reset (8eb2bc7)

Performance Improvements

• batch home page movie stats and cache compiled Twig templates (c1b866f)
• oauth: run OAuth monitoring from cron instead of every web request (5088bb7)