Version 1.16.2

Improvements

• adopt go-pkgz/rest v1.22.0: CORS Vary + enforcing Timeout, drop local reimplementations #2105 @paskal
• replace go-chi/chi router with go-pkgz/routegroup #2103 @paskal
• replace go-chi/cors with go-pkgz/rest CORS #2102 @paskal
• use stdlib http.ServeMux instead of chi in cleanup_test #2101 @paskal
• consolidate request middlewares into middleware.go #2100 @paskal
• replace chi middleware.RealIP with rest.RealIP on the main router #2099 @paskal
• replace chi middleware.NoCache with rest.NoCache on the main router #2098 @paskal
• replace chi middleware.Timeout with the timeout helper, drop chi/middleware #2097 @paskal
• replace chi middleware.Throttle with rest.Throttle on the main router #2096 @paskal
• migrate ssl.go TLS routers from chi to routegroup #2095 @paskal
• update frontend and site dependencies to latest, bump pnpm to 10, clear audit alerts #2091 @paskal
• update backend dependencies to latest #2088 @paskal
• bump the github-actions-updates group across 1 directory with 4 updates #2092 @app/dependabot
• bump webpack-dev-server from 4.9.3 to 5.2.4 in /frontend #2063 @app/dependabot
• bump postcss from 8.4.14 to 8.5.10 in /frontend #2056 @app/dependabot

Bug Fixes

• sanitize comment text in email notifications (GHSA-74pc-3r2m-ppx3) #2093 @paskal
• add --trusted-proxy to gate client-IP forwarding headers #2116 @paskal
• warn on catch-all trusted-proxy, cover more cases, trim wording #2118 @paskal
• surface real avatar-store errors on deleteme, tolerate only not-found #2113 @paskal
• remove user avatar on deleteme request #2104 @paskal
• make user deletion idempotent for users without comments 3fc5d6b
• ui error when no auth providers configured 406df02
• guard against falsy outputPath in eleventy htmlmin transform #2094 @paskal
• handle REST shutdown before server start 589e956