Daniel Salazar 7f0cd1689b fix(embed): only sibling subdomains not served by core can frame the app browser (#4515) ...

/embed/apps now names the referring origin in frame-ancestors only when it
is exactly one label under the domain and that label is not one the server
answers itself (api, dav, js, www, native-app hosts) or the host of
api_base_url. Nested subdomains are refused too.

The query-string redirect now checks the raw URL instead of the parsed
query, so every request carrying a query string is redirected.

2026-11-05 23:10:34 -07:00

..

i18n

Revise bug report and feature request instructions (#3220)

2026-06-18 09:27:55 -07:00

alarms.md

fix(alarm): forget idle alarms and cap how many the client holds (#4171)

2026-10-11 17:54:26 -07:00

architecture.md

docs: tighten contributor and architecture guides (#4194)

2026-10-11 22:07:02 -07:00

contributing-apis.md

fix(auth): support recovery codes when disabling two-factor auth (#4374)

2026-10-26 22:07:52 -07:00

embedding-app-browser.md

fix(embed): only sibling subdomains not served by core can frame the app browser (#4515)

2026-11-05 23:10:34 -07:00

license_header.txt

…

pagination.md

feat(events): fetch can start at the newest notification, and the feed uses it (#4479)

2026-11-04 10:15:14 -05:00

push-client.md

feat(notifications): push unless a page is visible and focused (#4506)

2026-11-05 14:43:33 -07:00

self-hosting.md

docs(install): explain how to install Docker instead of stopping at a dead end (#4411)

2026-10-30 19:33:01 -07:00