✨ New Features

• 6ae53bf - map OIDC/OAuth2 avatar claims to user pictureUrl (PR #7908 by @mod242)

🐛 Bug Fixes

• 3ba58f7 - apply theme style to embedded diagram svg (PR #7903 by @tribut)
• 3dcf20a - diagram svg styling add !important qualifier for light scheme (PR #7905 by @tribut)
• 7ae6635 - validate loginRedirect cookie to prevent open redirect (PR #7923 by @kolega-ai-dev)
• d14b0a5 - authenticate GraphQL subscription WebSocket connections (PR #7922 by @kolega-ai-dev)

🐛 Bug Fixes

• b950e06 - stop dompurify from breaking draw.io diagrams (PR #7888 by @tribut)
• 19c26e5 - handle breadcrumb locale prefix correctly (commit by @NGPixel)
• 857c172 - css editor in page properties dialog not loading (commit by @NGPixel)
• 7d4627b - rocketchat auth prototype pollution via userProfile function (commit by @NGPixel)
• 1d0d87a - add cookie secure flag when site is using https (commit by @NGPixel)
• 85c304f - add cookie secure flag when site is using https (client-side) (commit by @NGPixel)

🐛 Bug Fixes

• 29c8671 - breadcrumb path generation (commit by @NGPixel)
• 028dcd5 - use promisified pipeline from stream (commit by @NGPixel)

✨ New Features

• 5c80184 - add support for database connection via socketPath when using mysql2 driver (PR #7839 by @jjabba)

🐛 Bug Fixes

• cd77f36 - requests without user-agent causing error 500 (PR #7749 by @craigreyenga)
• b49c002 - Add missing status code on unauthorized access (PR #7785 by @dhulripos)
• 54d21ae - add tor1 region to DigitalOcean spaces list (PR #7832 by @bligneri)
• 407aacf - search: always ensure pg_trgm extension availability for PostgreSQL search (PR #7845 by @scottnursten-22)
• a02e013 - enhance logging for Google and GitHub OAuth2 authentication (PR #7848 by @ssk033)
• 326974c - profile: Prevent autofill on header search bar (PR #7688 by @Wingqvist)
  • ↘️ fixes issue #2324 opened by @saulimus
  • ↘️ fixes issue #3104 opened by @closewall
• 8b358fc - Update keycloak authentication definition hints (PR #7809 by @archessmn)
• 077ac97 - add locale to home icon breadcrumb nav (PR #7825 by @StofnerP)
• f68d1f6 - hide unfinished features (commit by @NGPixel)

♻️ Refactors

• 4eb9dab - update docker images to Node 24 and fix promisify calls (commit by @NGPixel)

🔧 Chores

• af83979 - update dependencies (commit by @NGPixel)

✨ New Features

• c093423 - set groups based on Azure groups (PR #7736 by @pianosaurus)

🐛 Bug Fixes

• 86abfea - update dompurify dependency + add cross-env (commit by @NGPixel)
• 1b6c67e - force wrap for code blocks in print view (commit by @NGPixel)

🔧 Chores

• 41d3ba4 - helm: render external database URL if it is set (PR #7036 by @nadiamoe)

🐛 Bug Fixes

• 78c41e3 - use xml-crypto 2.1.6 for passport-saml (commit by @NGPixel)

✨ New Features

• 403e98d - add git always namespace option (commit by @NGPixel)

🐛 Bug Fixes

• abc8dce - Allow HA_ACTIVE: True to enable HA mode (PR #7493 by @Vasfed)

🔧 Chores

• 94d253b - helm: add support for securityContext and resources in sideload container (PR #7350 by @maarous)

✨ New Features

• 7757de3 - add elasticsearch 8.x support (PR #6904 by @jacobacon)

🔧 Chores

• ab5c620 - update yarn lock (commit by @NGPixel)

🐛 Bug Fixes

• 904260f - set no-store cache control on jwt renew response (commit by @NGPixel)
• b9fb17d - prevent password reset on disabled account (commit by @NGPixel)
  • ↘️ fixes security advisory GHSA-vwww-c5vg-xgfc reported by @urda

🔧 Chores

• d1b4c8c - helm: add pod annotations (PR #7222 by @Mawarii)

🐛 Bug Fixes

• 1238d61 - move template expressions after dom-purify + handle text nodes without parent (commit by @NGPixel)
  • ↘️ fixes security advisory GHSA-xjcj-p2qv-q3rf reported by @Et43