Release 11.21.1

11.21.1 (2026-06-23)

🐛 Bug Fixes

• confine store paths against the resolved store dir (#4685) (a5dc881), closes pre-#4678 #4678
• don't return password hash in PUT /api/password response (#4687) (4b0b7d6)
• prevent symlinks from escaping the store directory (#4678) (592e1b8)
• refresh broadcast virtual nodes to avoid querying removed nodes (#4688) (8c1981e), closes #4677 #4677
• ui: separate virtual and physical devices in nodes table (#4673) (3a80ce6), closes #4672
• write self-signed TLS key/cert with owner-only permissions (#4686) (2f62656)