[1.17.11]
Update loomio to 3.0.22
Full Changelog
STV (Single Transferable Vote) poll type beta. Anonymous by default, results hidden until the poll closes. The form shows a warning asking users to report bugs and feedback on GitHub.
Cloudflare Turnstile challenge on password sign-in, login-token requests, signup, and trial creation. Admin login-link sign-in bypasses the challenge; sign-in with a login code also bypasses it.
Fixed SQL injection in HasTimeframe via timeframe_for.
Blocked SSRF in the link preview service; link previews now require auth and are throttled to 20/hour per user.
Direct upload size limit (25 MB trial, 1 GB paid); blocked dangerous uploads.
Bumped vue-i18n to 9.14.5 (XSS + prototype pollution).
Refresh a user's groups after joining or being added to a group.
Return a token error on session failure when a login token is pending; translate sessions errors server-side; surface server errors on login code entry.
Fix demo poll cloning (missing opening_at/opened_at).
Translation fixes: needs_a_rethink_meaning, "vote in" "vote on", German typo in discard.