v1.13.7

• SECURITY
  • Update to bluemonday-1.0.6 (#15294) (#15298) CVE-2021-29272
  • Clusterfuzz found another way (#15160) (#15169)
• API
  • Fix wrong user returned in API (#15139) (#15150)
• BUGFIXES
  • Add 'fonts' into 'KnownPublicEntries' (#15188) (#15317)
  • Speed up enry.IsVendor (#15213) (#15246)
  • Response 404 for diff/patch of a commit that not exist (#15221) (#15238)
  • Prevent NPE in CommentMustAsDiff if no hunk header (#15199) (#15201)
• MISC
  • Add size to Save function (#15264) (#15271)