v2.5.0

2.5.0 (2026-07-21)

Security

• patch CVE dependencies and path traversal risks (00f3abd)
  • upgrade aiohttp to 3.14.2 and refresh related runtime packages
  • harden local file/share path checks against traversal
  • use constant-time password comparison and urlsafe JWT encoding
  • default Docker FORWARDED_ALLOW_IPS to empty to avoid spoofed proxy headers

Features

• add global storage capacity limit (818dd47)
• automate version releases (ee8f908)
• configure admin session lifetime (#484) (93ff291)

Bug Fixes

• build frontend on native Docker platform (2c51384)
• harden automated release workflow (46883c9)
• harden share retrieval and admin visibility (#482, #480) (8d7d856)
• resolve docs dependency audit warnings (36300ef)

Note: this tag was republished to include the security fix above. Prefer v2.5.1 for the canonical latest release line.