Stream Engine 0.6.1

Added

• Added articles.list-id, articles.list-slug, articles.index and articles.by-term page actions; list page size is configurable and related articles are opt-in.
• Audio uploads store title and artist tags; the player and its accessible label
  use them, falling back to the post title and filename.

Fixed

• Module discovery no longer loads global vendor classes that can terminate PHP.

Security

• Rate-limited login and password recovery; password resets are atomic and
  invalidate existing sessions.
• Enforced parent-content access for comments, disabled caching of private
  responses, and restricted CSS in user-authored content.
• Hardened upload response headers and documented secret-URL access for private
  attachments; verified isolation of file-browser data from vulnerable theme merges.

Upgrade notes

• Back up the database and persistent files, install dependencies from the
  lockfiles, and run composer migrate. This release includes
  20261101000000_rename_articles_list_action,
  20261102000000_add_auth_rate_limits, and
  20261108000000_add_upload_audio_tags.
• Stored articles.list actions are migrated to articles.list-slug; update
  module definitions that still use the old action name.
• The fresh-install schema and manifest are regenerated for 0.6.1. Use
  migrations for existing installations; do not import schema.sql over them.
• Deploy the bundled rebuilt browser assets and updated Nginx configuration
  for hardened upload response headers. Private attachments use secret URLs;
  see SECURITY.md for the access model and its limits.
• Dependency audit: the Chonky/deepmerge chain retains three low-severity
  advisory entries with no upstream fix. File-browser data is isolated from
  vulnerable theme merges; the reviewed mitigation is documented in SECURITY.md.
• Database rollback requires restoring the matching backup; down migrations
  are not provided.

Full changelog: v0.6.0...v0.6.1