v0.7.2

Highlights

Security

• Open redirects closed: the practice switch and todo toggle trusted the path of the Referer header, but https://evil//evil/x has the path //evil/x, a protocol-relative off-site redirect (#485).
• Calendar import endpoints no longer return raw exception text to the browser (#485).
• Path traversal hardened: client codes are slugified in document upload paths, and questionnaire codes from the URL must be lowercase slugs (#485).
• CI supply chain: GitHub Actions pinned to commit SHAs, 3-day Dependabot cooldown, script injection in image.yml fixed (#484).

Fixes

• 20-minute intro calls were billed, and calendar events were booked onto unrelated clients whose two-letter code happened to appear inside a word ("Nat", "Blocked"). Codes must now stand alone, and intro calls map to the correct service type again (#477).
• The UI holds together down to a 768px window: button rows wrap and wide tables scroll inside their own container (#474).
• The German treatment contract keeps its signature block together on one page (#475).

Chores & deps

• Abandoned async spike and the uvicorn pin removed (#476).
• cryptography 50.0.2, markdown 3.11, python-dotenv 1.2.4, google-auth family, source-map-js 1.2.2 (GHSA-68fv-2mgg-jv7q).

No migrations. Update with ./prod.py update.

Full changelog: docs/CHANGELOG.md