⚠️ Security fixes

Fix an incorrect access check in the legacy contribution export API that could leak extra contribution metadata through cache poisoning (GHSA-p9vj-86c7-h7q3)
Fix a path traversal vulnerability in the offline-copy feature that could lead to the disclosure of local file contents (CVE-2026-107398)

Note

Updating as soon as possible is strongly recommended, and it is generally advisable to limit event creation (and management) to trusted individuals.

🎉 Improvements

Support multi-choice abstract/contribution fields (#7725)
Add option to limit the number of review rounds in Paper Reviewing (#6600, #7187)
Add new regform setting to allow withdrawing a registration outside the modification period (enabled by default for new forms) (#7769)

Fix "No value" filter for text-based abstract/contribution fields (#7725)
Fix error when loading favorite contribution state when viewing a contribution in a restricted event the user cannot access (#7740)
Fix "My contributions" page not working when "My timetable" menu entry is disabled (#7759)
Fix paper submission button not showing up for authorized late submitters (#7766)
Fix shift-click bulk selection in data tables misbehaving after sorting (#7777)
Prevent caching of /assets/js-vars/user.js by CDNs and proxies (#6891, #7782)
Hide edit/remove buttons on disabled accompanying persons field (#7785)
Correctly show locked/purged field indicators on registration form fields (#7785)
Fix error on dashboard iCal download when providing a from date (#7794)

Allow plugins to declare file-backed config keys via the plugin_config_defaults class attribute. Keys are exposed in indico.conf under the reserved PLUGIN_<NAME>_ namespace, with parity for defaults, sanitization and INDICO_CONF_OVERRIDE (#7499, thanks @moliholy, @unconventionaldotdev)
Add new signals to allow restricting which registrations someone can manage (#7611, thanks @moliholy, @unconventionaldotdev)
Fix building JS assets on Node 26 (#7793)