v0.5.125
·
442 commits
to main
since this release
What's Changed
- Prevent raced first-user registrations from becoming admin by @glenn-sorrentino in #1702
- Escape directory JSON before client-side rendering by @glenn-sorrentino in #1701
- Require invite codes by default on fresh installs by @glenn-sorrentino in #1703
- Handle legacy account_category values without 500s by @hushline-dev in #1705
- Harden runner failure-context redaction before Codex prompt upload by @hushline-dev in #1706
- fix: redact sensitive values from runner failure excerpts by @hushline-dev in #1704
- Fix new-database-migration to validate MESSAGE env var by @hushline-dev in #1707
- Fix delete confirmation to block field deletion on cancel by @hushline-dev in #1708
- Harden CSP by removing
unsafe-evalfrom script-src by @hushline-dev in #1709 - Harden CSP by removing inline script allowance from script-src-elem by @hushline-dev in #1710
Full Changelog: v0.5.124...v0.5.125