v1.17.0

1.17.0 (2026-08-05)

Added

• analytics: anonymous viewers can erase their own data (session-token proof-of-possession) (#637) (52b7f41)
• analytics: drop the internal/external tracking toggle, leaving analytics.enabled as the only switch (#635) (0172041)
• api: carry ownerId as the identity in responses and compare it on the client (#640) (5d653d2)
• authz: decide presentation ownership on users.id instead of the email string (#638) (1b5c229)
• authz: decide the workspace grant against the actor's own organization (L10) (#639) (566d970)
• identity: key user_settings on users.id (T10 PR E) (#643) (a0c2af9)
• identity: verify and backfill the identity data migration (T10 PR G) (#646) (6ea1181)
• notes: let the join link edit the session's speaker notes (#632) (e6823c9)

Fixed

• analytics: make the identifier the scope on the last two org-blind seams (#629) (688c843)
• collaborators: a failed invite insert answers 500, not 400 (#642) (d389a32)
• db: honor DATABASE_URL over DATABASE_* in db:migrate (#631) (19a4f28)
• export: queued exports load their theme through loadTheme (#641) (7f56e38)
• share: branch the invite failure on e.code, not on the message (#645) (39e548a)

Security

• analytics: drop sessionToken from the sessions list response (#636) (51cb500)
• analytics: return a per-deck device label instead of the raw device id (#634) (23748b4)