0.27.1

Security

• Validate the sortBy list-view parameter against column_sortable_list GHSA-ccg5-9c8w-xh6v

ModelView.sort_query() did not check the attacker-controlled sortBy
query parameter against the configured column_sortable_list allow-list,
so a request could sort by any column of the model (including ones hidden
from column_list) and by related-model columns via a dotted path —
turning row order into an information-exposure ordering oracle. sortBy
is now rejected with HTTP 400 unless it is present in the configured
sortable columns.

Full Changelog: 0.27.0...0.27.1