Linus Rath 468c1aac0c fix: refuse marketplace bundles whose id differs from the directory entry

2026-10-14 01:32:44 +02:00

..

audit

fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00

auth

chore: write nul separators as \0 so git diffs these files as text

2026-09-30 19:34:37 +02:00

branding

Feature: configurable PWA install screenshots (per-domain)

2026-05-30 15:45:59 +02:00

change-password

fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00

config

feat: generate a session secret on first start when none is configured

2026-10-13 13:17:34 +02:00

marketplace

fix: refuse marketplace bundles whose id differs from the directory entry

2026-10-14 01:32:44 +02:00

oauth/setup

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

plugin-approvals

fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00

plugins

feat: add privileged same-origin plugin tier + crypto API surface

2026-06-28 16:51:42 +02:00

policy

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

telemetry

fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00

themes

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

version

fix: invalidate persisted update status after an upgrade

2026-08-29 12:46:39 +02:00