Tink bot aa1956e1aa fix(oauth2server): accept all loopback redirect forms ... Hardcoding the three exact strings localhost / 127.0.0.1 / ::1 rejected legitimate loopback redirects like 127.0.0.2:1234 (anywhere in 127.0.0.0/8) or [0:0:0:0:0:0:0:1]:1234 (expanded IPv6 loopback). Use net.IP.IsLoopback() to cover the full loopback ranges, and match "localhost" case-insensitively. 0.0.0.0 stays rejected as it is not a loopback address. https://claude.ai/code/session_01LsTDrCJ7trE6WQ4FYf78UB		2026-05-07 22:03:49 +00:00
..
auth	fix(oauth2server): accept all loopback redirect forms	2026-05-07 22:03:49 +00:00
avatar	feat(avatar): use distinct marble palette for bot users	2026-05-01 14:44:10 +00:00
background	fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients	2026-04-09 07:31:08 +00:00
dump	chore(lint): suppress known gosec false positives	2026-03-23 16:23:15 +01:00
keyvalue	fix: fatal with clear message when keyvalue type is redis but redis is not enabled	2026-04-12 09:43:31 +00:00
migration	feat(migration/wekan): import attachments from board export	2026-04-13 16:04:14 +00:00