v0.20.0

Fixed

• The OpenAPI contract now describes the webhook filters shape on all three DTOs — conditions with its 1..20 bounds — instead of a bare object schema. Runtime validation is unchanged.
• GET /infra/config now resolves each field with boot precedence — host env, then project .env, then data/.env.generated — so Compose-set ENGINE_TYPE/DATABASE_TYPE/REDIS_ENABLED no longer read back as first-run defaults (#1313, #1082).

Security

• Status media is served as an inert download: image/svg+xml in any form becomes application/octet-stream with Content-Disposition: attachment, matching the chat-media route.
• Session credential directories (engine profiles, Baileys auth state) are created 0o700 and re-tightened on every start.
• Webhook HMAC secrets require 16+ characters when set (existing secrets keep working; re-saving a short one fails); ingress event payloads persist credential and signature headers redacted; delivery-failure errors redact host:port; the ingress reflections answer text/plain.
• ⚠️ Breaking (config). With WEBHOOK_SSRF_PROTECT=false, deliveries no longer follow redirects — set WEBHOOK_SSRF_REDIRECTS=true for a receiver behind a 3xx; SSRF_ALLOWED_HOSTS entries are now pinned to their resolved addresses (and must resolve at registration time).
• ⚠️ Breaking (config). Plugin installs from a URL require a #sha256=<64 hex> pin when NODE_ENV=production (the compose default). Action required: catalog installs without a pin fragment now fail — pin the URL or set PLUGIN_INSTALL_REQUIRE_PIN=false; SECURITY.md documents the plugin trust model.

Added

• Weekly scheduled security scan (security-scan.yml): re-runs the dependency audits and scans the published latest image on both architectures; also dispatchable on demand.
• Client wire-shape gate (check:contract-shapes, CI lint job): checks the JavaScript, Python, Go and Java clients' and the dashboard's wire types against the OpenAPI schemas, field by field — 113 pairs gated. Two Go wire bugs it surfaced are fixed: WebhookResponse.Events and ChatHistoryMessage.MentionedIds were modelled as strings where the wire carries arrays.