4.3.0-beta-3

Features

• Add MCP support for the Vito API by @saeedvaziry in #1293
• Add bulk firewall rule creation and Cloudflare IP import by @saeedvaziry in #1294
• allow deploying a specific commit through the API by @klaasnicolaas in #1275

Fixes

• prevent backup retention from flooding the queue with duplicate delete jobs by @Sayed-Kerkesh in #1281
• Run application components as isolated users by @saeedvaziry in #1292
• Escape database user passwords in create and update scripts by @saeedvaziry in #1296
• re-sync deploy key when updating site source control by @urufudev in #1241
• Alias domains can now be verified before they are active by @theveug in #1279
• Update broken documentation links in README by @saeedvaziry in #1299
• Security batch 01: reset-link host, invitation tokens, log rename, notifier scope, raw-log XSS by @saeedvaziry in #1300
• Security batch 02: account hardening, demo guards, admin export, install/docker scripts by @saeedvaziry in #1301
• Security batch 03: realtime access revocation, socket limits, script execution scope by @saeedvaziry in #1302
• Security batch 04: workflows, env parsing and masking, bounded reads by @saeedvaziry in #1303
• Clean up comments and PHPDoc across the codebase by @saeedvaziry in #1304

New Contributors

• @Sayed-Kerkesh made their first contribution in #1281
• @urufudev made their first contribution in #1241
• @klaasnicolaas made their first contribution in #1275
• @theveug made their first contribution in #1279

Full Changelog: 4.3.0-beta-2...4.3.0-beta-3