Stable-Releases vom 24. Oktober 2026¶
Alle Änderungen, die am 24. Oktober 2026 im Stable-Kanal erschienen sind — v2.10.64.
Stable v2.10.64 — Security¶
Bugfixes & Security — v2.10.64¶
- Check site ownership before any agent call, not just before DB takeover
- Persist mail migration job ownership across restarts
- Replace dead ownership check on site thumbnail endpoint
- Verify mailbox migration job ownership before returning status
- Close third unchecked-:uid call site, PUT grants
- Verify MariaDB username belongs to the owned database before drop/reset
- Close fail-open customer_id lookup on wp-import routes
Stable v2.10.64¶
Features — v2.10.64¶
- Require ALTCHA proof-of-work on forgot-password
Improvements — v2.10.64¶
- Guard enhance's www-alias queue against name collisions
- Auto-create www alias for imported domains
- Stop Popconfirm onConfirm from bubbling into customer-header toggle
- Keep per-customer re-sync button visible after completion
- Use WebFilesRef for subdomain rsync source, not stale container DocRoot
- Settle altcha proof-of-work difficulty at the library default
- Raise altcha proof-of-work difficulty well above the library default
- Surface the backend altcha error code on forgot-password