fix: security release 2026-08-12 - #4735

Merged

carderne merged 7 commits into

mainfrom

security-release/2026-08-12

Aug 20, 2026

Commits on Aug 20, 2026

fix(webapp,dashboard-agent): stop client-injected repoSnapshot tarball URLs reaching the agent worker (#95)
carderne
authored
e05c293
fix(webapp): close abuse rate-limit gaps in magic link, MFA disable, and invites (#92)
carderne
authored
39174be
fix(tsql): reject PREWHERE clauses (#91)
carderne
authored
f92b766
fix(webapp): scope dashboard waitpoint completion to environments (#90)
carderne
authored
201d899
fix(webapp): bind Slack OAuth callbacks to one-time state (#82)
carderne
authored
0011a21
Merge remote-tracking branch 'upstream/main' into release/2026-08-12
trigger-release-bot[bot]
committed
1fe5326
Merge remote-tracking branch 'upstream/main' into release/2026-08-12
trigger-release-bot[bot]
committed
753d4a1