v5.5.0

5.5.0 (2026-09-01)

Features

• let admins allow standard users to use the Webhook Allowlist (closes #1153, closes #1138) (41494ef)

Bug Fixes

• auth: actually delete the login token on logout (#1184) (41494ef)
• auth: make the TOTP replay guard run (#1181) (41494ef)
• close remaining gaps in login-token revocation from #1184's review (41494ef)
• OIDC token exchange failing behind CDN/anycast proxies (closes #1145) (41494ef)
• payment method in-use guard misses when 2+ subscriptions share it (closes #1179) (41494ef)
• reflected XSS via unescaped theme cookies in inline scripts (41494ef)
• reject deleting or disabling an in-use payment method on every path (41494ef)
• undefined array key warnings for subscriptions with no seeded stats bucket (closes #1182) (41494ef)