main
security: restrict ipynb sanitizer to safe image data URIs (#8326)
Move sign-in MFA step to React with /api/web/user/mfa (#8288)
all: rename packages ending with "util" to end with "x" (#8182)
chore: replace pkg/errors with cockroachdb/errors (#8098)
conf: resolve session and TLS cert paths against work directory (#8386)
web: remove the install page (#8350)
chore: remove all MIT license file headers (#8083)
security: enforce RESET_PASSWORD_CODE_LIVES on reset tokens (#8328)
security: don't follow redirects on webhook delivery (#8263)
security: verify content hash on LFS dedupe shortcut (#8333)
security: close SSRF in repository migration and recurring mirror sync (#8324)
web: migrate commit page with @pierre/diffs and @pierre/trees (#8295)
security: reject path traversal in owner and repository names (#8334)
security: time out stalled SSH handshakes after 15s (#8335)
web: move password reset to React (#8290)
Replace github.com/unknwon/com with stdlib and internal helpers (#8148)
tool: avoid panic in BasicAuthDecode on a value with no colon (#8387)
security: harden same-site redirect validation (#8391)