v2026.10.17

Field limits the rate of every route, with smaller limits for sign-in, email, PDFs and integrations.

AI agents and tools can read these release notes as plain Markdown.

This release covers 16 pull requests.

Highlights #

• Field limits the rate of every route, with smaller limits for sign-in, email, PDFs and integrations. (#151)
• The MCP OAuth router has its own rate limit, and job detail keys are checked where they are set. (#153)
• Email HTML is cleaned by a real HTML parser. (#152)
• Passwords are stored as salted scrypt hashes, and older SHA-256 hashes are upgraded at sign-in. (#148)
• Release jobs build from the release tag, and stop if the tag moved. (#149)

Fixes #

• Field rate-limits every route, with smaller budgets for sign-in, email, PDFs and integrations. (#151)
• Email HTML is sanitised by a real HTML parser, and the escaping, regex and input alerts are closed. (#152)
• Release jobs build from the release tag, and stop if it moved. (#149)
• Passwords are stored as salted scrypt, and older SHA-256 hashes are upgraded. (#148)
• The MCP OAuth router carries its own rate limit, and job detail keys are checked where they are assigned. (#153)

Contribution record #

CHANGELOG/records/2026.10.17.md lists every pull request in this release once, with its related issues and thanks.