Release 0.2.61 (2026-07-01) · ephes/django-cast

0.2.61 (2026-07-01)

Added the session-authenticated /api/editor/ content editing API for trusted clients, including draft create/read/update, explicit publish actions, episode endpoints, media list/upload endpoints, scoped-token enforcement, and rendered draft previews.
Added podcast publishing metadata: seasons, episode numbers/types, Apple Podcasts ordering type, and opt-in automatic episode numbering.
Added opt-in anonymous comment self-editing and deletion for same-browser commenters.

Hardened editor media upload validation, probing timeouts, per-user upload locks, and image chooser validation.
Added public transcript storage separation, private voice-reference storage fallback, and safer media maintenance commands.
Updated the JavaScript toolchain to Vite 8 and refreshed frontend lockfile dependencies.

Tightened Wagtail admin permissions for audio, video, and transcript chooser/edit/delete views.
Fixed multiple restricted-content exposure paths across public surfaces, transcript previews, gallery modal URLs, and closed comment endpoints.
Made Podlove player embedding fail closed when no first-party embed script URL is configured.

Expanded API, settings, podcast/feed, comments, media, and management-command documentation for the new release surface.
Added release notes and validated the release with just check and the full tox matrix across supported Python/Django/Wagtail combinations.