v2026-04-16.1

Changes since v2026-04-15.1

Security

• Path traversal hardening for community modules: All file references from module manifests (contributes values) are now validated through shared path sanitizers before reaching any filesystem operation. This prevents a malicious community module from reading, serving, or executing files outside its own directory.
  • Affected paths: routes, collector, publisher, driver, thresholds, theme, i18n, static, tab, card, settings
  • Plain filenames are validated against a strict character allowlist
  • Subdirectory references are checked for traversal sequences and directory containment
  • CodeQL py/path-injection alerts #73 and #74 are resolved

Maintenance

• Extracted shared path-safety utilities into app/path_safety.py for consistent validation across install and load paths
• Contribution guide wording refreshed