Offset Align 0.2.33

This release fixes the issues found in our security audit of 24 October 2026. No critical or high-severity issues were found. We recommend updating.

Fixed

• Files with Arabic, Chinese, Hindi or emoji names can now be downloaded. Before, they uploaded but gave an error on download.
• A wrong sign-in now takes the same time whether or not the username exists, so it no longer hints which usernames are real.
• If someone types their password into the username box by mistake, it is no longer stored in the audit trail or the sign-in log.
• Linking a record to something that no longer exists now shows a clear message instead of "Something went wrong".

Hardened

• Updated components with published security fixes: zod 4, nodemailer, Fastify and fast-uri.
• Smaller, cleaner Docker images. npm and development tools are removed, and the base system is up to date. The app image now has no known vulnerabilities.
• Every build tool used to make a release is pinned to an exact version.
• The page can no longer ask for the camera, microphone or location.

Documentation

• SECURITY.md now describes exactly the security features the product has. Multi-factor sign-in and single sign-on are not yet available; multi-factor sign-in is planned for Q1 2027.

No action is needed after updating. Your data and settings are unchanged.