5.3.2

• OTPAuthMiddleware only follows the post-login next parameter when it points to the current host (url_has_allowed_host_and_scheme); anything else redirects to LOGIN_REDIRECT_URL. - GenList bounds the client-supplied pages_to_bring to the number of existing pages (new helper codenerix.views.bounded_pages_to_bring); non-numeric values fall back to 1. - The LDAP backend no longer forces TLS 1.0 when AD_SSL is enabled; ldap3 now negotiates the protocol with Python's default SSL context (TLS 1.2 or later). Directory servers that only speak TLS 1.0 will no longer connect.

• ThrottledAdminEmailHandler no longer reads the clock at import time to initialise its cleanup timer.