Changelog

What's new?

No new features in this release.

What's fixed?

• Release and installation documentation now separates release-candidate images from production image defaults and refreshes screenshot and network-access guidance.
• Parent account deactivation now preserves the last active parent and the last active parent administrator while cleaning up that parent's push subscriptions.
• Child-only network access now leaves parent login and password recovery available from a device with an active child session.
• Django is updated to 5.2.17 for the latest supported security fixes.

What's new?

No new features in this release.

What's fixed?

• Parent account management now distinguishes ordinary parents from parent administrators, while scheduled backups retry temporary failures with bounded same-day backoff.
• The deployment Compose network now gives the application only the outbound access it needs while keeping backup control traffic internal.
• Proposal, reward, and related pending-state transitions now claim rows conditionally so concurrent requests cannot both win on SQLite.
• Failed upgrades now stop with a compatibility warning instead of silently restoring an older image after migrations may have changed the database.
• Web Push subscriptions now validate public HTTPS endpoints and structurally valid keys, enforce per-owner limits, and exclude inactive parent accounts.
• Child-only network restrictions now also cover active child sessions on shared feedback and screenshot routes.

What's new?

No new features in this release.

What's fixed?

• Child dashboards now show a personalized greeting with a safe fallback when a name is unavailable.
• Paired child devices now receive automatic icons, broad non-fingerprinting browser/device identification, a stable short ID, last-seen status, and rolling cookie renewal while actively used.
• Parent account settings now use a clearer account-type selector and dialog-based editing, while pending requests receive stronger visual emphasis.
• Production settings now default DEBUG to False and require an explicit secret key when debug is disabled.
• Application responses now include a nonce-based Content Security Policy, while preserving the existing local scripts, image previews, and styles.
• CI now audits the locked Python dependency set with pip-audit, and Dependabot monitors Python and GitHub Actions dependencies.

What's new?

No new features in this release.

What's fixed?

• Application URLs now use canonical lowercase English paths independently of the selected interface language. Existing Lithuanian links remain usable through permanent GET redirects, while mutating requests continue to reach the same views without losing their method or body.
• Push notifications, feedback flows, network restrictions, and the Service Worker now use named canonical routes, keeping URL changes consistent across the application.
• Pull requests now run locked Python dependency, Ruff, Django, deployment, migration, dependency, and test checks, with strict documentation checks for docs-only changes.
• Legacy redirects now preserve only valid changelog pagination and safe internal login destinations; unknown, malformed, or unsafe query values are discarded.
• Git and Docker build contexts now exclude environment files, databases, uploads, backups, secrets, caches, and other local runtime artifacts.

What's new?

• Parent and child pages now detect relevant family-state changes automatically, with visibility-aware polling, request backoff, and optional Web Push signals.

What's fixed?

• The Service Worker now handles Web Push and lightweight state-change signals without intercepting document navigation or maintaining an offline HTML fallback.
• The language menu now remains above public welcome and sign-in page content, so its English and Lithuanian flag buttons receive clicks and switch language through the native Django POST and redirect flow.
• Parent pending requests now refresh as one revisioned fragment without interrupting an active dialog or focused control, and newly inserted evidence photos continue to open in the lightbox.
• Parent polling is limited to the Parent dashboard, while child polling remains limited to an active child session; both stop safely when authorization is no longer valid.
• The production dependency lock now pins cryptography 50.0.0.
• Backup configuration, status, and KinKudos database-copy paths now enforce owner-only permissions and reject unsafe directory symlinks.
• The release workflow now installs the locked Python 3.12 dependencies and rejects unexpected Django deployment-check warnings before image publication.