v1.18.0

🔒 Security

• Prevent path traversal on project file endpoints (GHSA-4g5x-hcwm-82jw)
• Scope project & project_file lookups by namespace_id to enforce tenant isolation
• Harden path, shell, and repo URL handling: extract dedicated safe_path, shell, repo_url, local_path utilities and add unit tests

✨ Features

• Fix external login callback link being intercepted; extract login callback parameter parsing utility (#148)
• Raise tag list default page size to 50 (#147)

🐛 Bug Fixes

• Fix Promise warning
• Fix notify template error (#145)
• Fix custom command parsing failures (multiple parse-error fixes)

♻️ Refactor

• Refactor element-plus usage

📦 Dependencies

• Bump golang.org/x/crypto from 0.31.0 to 0.45.0 (#154)
• Bump vue-i18n, @intlify/core, solid-js, vite/@vitejs/plugin-vue, nanoid (web)

Full Changelog: v1.17.5...v1.18.0