Stable releases of October 24, 2026

Everything that shipped on the stable channel on October 24, 2026 — v2.10.64.

Stable v2.10.64 — Security

Bugfixes & Security — v2.10.64

• Check site ownership before any agent call, not just before DB takeover
• Persist mail migration job ownership across restarts
• Replace dead ownership check on site thumbnail endpoint
• Verify mailbox migration job ownership before returning status
• Close third unchecked-:uid call site, PUT grants
• Verify MariaDB username belongs to the owned database before drop/reset
• Close fail-open customer_id lookup on wp-import routes

Stable v2.10.64

Features — v2.10.64

• Require ALTCHA proof-of-work on forgot-password

Improvements — v2.10.64

• Guard enhance's www-alias queue against name collisions
• Auto-create www alias for imported domains
• Stop Popconfirm onConfirm from bubbling into customer-header toggle
• Keep per-customer re-sync button visible after completion
• Use WebFilesRef for subdomain rsync source, not stale container DocRoot
• Settle altcha proof-of-work difficulty at the library default
• Raise altcha proof-of-work difficulty well above the library default
• Surface the backend altcha error code on forgot-password