Features
Fixes
- fix(api): only read caption tracks whose language code is a plain namebde8b8de
- fix(api): build single-tenant credential links from trusted origins onlye0ee5ba5
- fix: address review findings in the hardening round33ed0d29
- fix(api): treat superadmin API tokens as superadmin in resource checks174a8dc2
- fix(api): resolve API token principals and enforce token rightsd343f311
- fix: cap request bodies and unauthenticated collab connectionsc525ea72
- fix(web): verify subscription state before applying a billing plan672b7282
- fix(api): apply reader gates to folders, assignments, code runs and mediad8e3d399
- fix(auth): harden email verification, email change, reset and sign-in flowse2b24854
- fix(api): tighten org admin actions and clean up access on member removal6063287f
- fix(deps): update all non-major dependencies to v1.43.1090dc5073a
- fix: enforce admin API token rights, CSRF checks and export scope3482e9f5
- fix: harden auth flows, content access, privacy and resource limitsa2558c55
- fix(deps): patch vulnerable Next.js, sharp and transitive packagesf600f385
- fix: task ordering, callout lists, markdown in AI editor repliesf3c646ac
- fix(deps): update dependency stripe to v23e0bceebd
- fix(deps): update dependency stripe to v16ef0d69e9
- fix(deps): update dependency motion to v14c0119ae2
- fix(deps): update all non-major dependencies79eb08be
- fix: scope roles to their org and harden admin, email and plan pathsa6590c7c
- fix(web): run bun tests with --isolatef96f4edb
- fix: forward session auth in SCORM proxybef5783b
- fix: tighten access checks across orgs, content and accounts0ce31fc3
- fix(api): enforce read access on content-derived endpoints7b8a3e22
- fix: refresh uv.lock on release version bumpfbdd24b3
- Merge pull request #1151 from learnhouse/fix/security-hardening-round6be0057e0
- Merge pull request #1146 from learnhouse/renovate/all-minor-patcha35c73c5
- Merge pull request #1142 from learnhouse/fix/access-control-2026-10-part3554688d4
- Merge pull request #1141 from learnhouse/fix/deps-security-2026-106b16c5c6
- Merge pull request #1138 from learnhouse/fix/issues-1075-1131-1137bc5ca950
- Merge pull request #1135 from learnhouse/renovate/stripe-23.xa346e362
- Merge pull request #1134 from learnhouse/renovate/stripe-16.x9e3346a2
- Merge pull request #1133 from learnhouse/renovate/motion-14.x250c9d61
- Merge pull request #1132 from learnhouse/renovate/all-minor-patch54996d68
- Merge pull request #1128 from learnhouse/fix/access-control-2026-10-part2b608f735
- Merge pull request #1120 from learnhouse/fix/access-control-2026-109a131918
- Merge pull request #1127 from learnhouse/fix/scorm-proxy-auth682d8f8e
- Merge pull request #1123 from learnhouse/fix/sentry-sweep-followupa9ae9a54
- Merge pull request #1124 from learnhouse/fix/payments-authzfae647dc
- Merge pull request #1118 from learnhouse/fix/release-uv-lockc8515a6f
Performance
- perf(web): cache resolved Intl localese83f9d8f
Refactoring
Documentation
Maintenance
- chore(docs): remove Vercel Web Analytics36a467c6
- chore: drop duplicate superadmin importa42e4bdd
- chore: replace remaining em dashes in onboarding, admin notices, and an error message834630e6
- chore: take over release script and test-audit note edits47054344
- chore: move release script comment edit to avoid PR overlap94490a3e
- chore: replace em dashes in user-facing and runtime strings7dfb24dc
- chore: smooth wording in rewritten commentsb014014b
- chore: replace em dashes in comments and docstrings9410fcd8
- Merge pull request #1150 from learnhouse/chore/docs-drop-vercel-analytics4670a7df
- Merge pull request #1125 from learnhouse/chore/string-dashes5d57f3b0
- Merge pull request #1122 from learnhouse/chore/comment-dashes52e871d4
Contributors
npx learnhouse update --to 1.4.0