The size constraint on plugin zips for the PendingRelease domain class had been updated, but there was also a command object with the same set of constraints that hadn't been updated: PublishPluginCommand. The command object now imports the constraints from PendingRelease so we don't have to update them in two places.
The database was getting into a confused state when the PluginUpdateService threw a checked exception because the plugin tabs were created, but the corresponding plugin entry was not. This then prevented users from publishing the plugin until the database was fixed. Checked exceptions now trigger a rollback so the database can't get into that state.
The app was doing some basic saving of form submission data before redirecting to the login page. Unfortunately it was a rather naive implementation that didn't work but did introduce a problem with duplicate fields when submitting from the login or registration pages. All that code has been removed because it doesn't work. At some point, it would be good to handle authentication during form submission better so users don't lose their data.