Changelog: release 6.6.0

[github-actions]

Release 6.6.0

• Date: 17. August 2026
• Tag: v6.6.0
• Source: kellnr/kellnr

Added

• (kellnr) add baseline security headers to all responses

Changed

• (ui) remove dead highlight.js theme-link toggling
• (ui) drop redundant highlight.js theme CSS import
• (db) backtick DoS in escape_like_pattern doc comment
• update flake.nix
• (deps) bump hyper from 1.10.1 to 1.11.0 (#1337) (#1337)
• (deps) bump the npm-all group in /ui with 7 updates (#1335) (#1335)
• (deps) bump hyper from 1.10.1 to 1.11.0
• (deps) bump sea-orm-migration from 2.0.0 to 2.0.1 (#1336) (#1336)
• (deps) bump moka from 0.12.15 to 0.12.16 (#1334) (#1334)
• (deps) bump async-trait from 0.1.91 to 0.1.92 (#1333) (#1333)
• (deps) bump thiserror from 2.0.19 to 2.0.20 (#1332) (#1332)
• (deps) bump taiki-e/install-action from 2.85.8 to 2.85.12 (#1331) (#1331)
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps) bump sea-orm-migration from 2.0.0 to 2.0.1
• (deps) bump the npm-all group in /ui with 7 updates
• (deps) bump moka from 0.12.15 to 0.12.16
• (deps) bump async-trait from 0.1.91 to 0.1.92
• (deps) bump thiserror from 2.0.19 to 2.0.20
• (deps) bump taiki-e/install-action from 2.85.8 to 2.85.12
• update syn dependency
• (deps) bump sea-orm from 2.0.0 to 2.0.1 (#1329) (#1329)
• (deps) bump base64 from 0.23.0 to 0.23.1 (#1328) (#1328)
• (deps) bump the npm-all group in /ui with 10 updates (#1325) (#1325)
• (deps) bump sea-orm from 2.0.0 to 2.0.1
• (deps) bump time from 0.3.54 to 0.3.55 (#1326) (#1326)
• (deps) bump tokio from 1.53.0 to 1.53.1 (#1324) (#1324)
• (deps) bump taiki-e/install-action from 2.85.4 to 2.85.8 (#1323) (#1323)
• (deps) bump base64 from 0.23.0 to 0.23.1
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps) bump time from 0.3.54 to 0.3.55
• (deps) bump the npm-all group in /ui with 10 updates
• (deps) bump tokio from 1.53.0 to 1.53.1
• (deps) bump taiki-e/install-action from 2.85.4 to 2.85.8
• (deps) bump postcss from 8.5.19 to 8.5.25 in /ui (#1322) (#1322)
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps) bump postcss from 8.5.19 to 8.5.25 in /ui
• (deps-dev) bump undici from 8.7.0 to 8.10.0 in /tests (#1321) (#1321)
• (deps-dev) bump undici from 8.7.0 to 8.10.0 in /tests
• (deps) bump base64 from 0.22.1 to 0.23.0 (#1315) (#1315)
• (deps) bump base64 from 0.22.1 to 0.23.0
• (deps) bump quote from 1.0.46 to 1.0.47 (#1318) (#1318)
• (deps) bump sea-orm-migration from 2.0.0-rc.43 to 2.0.0 (#1317) (#1317)
• (deps) bump serde_json from 1.0.150 to 1.0.151 (#1319) (#1319)
• (deps-dev) bump the npm-all group in /ui with 2 updates (#1314) (#1314)
• (deps) bump sea-orm-migration from 2.0.0-rc.43 to 2.0.0
• (deps) bump quote from 1.0.46 to 1.0.47
• (deps) bump clap from 4.6.1 to 4.6.4 (#1316) (#1316)
• (deps) bump taiki-e/install-action from 2 to 2.85.4 (#1313) (#1313)
• (deps) bump serde_json from 1.0.150 to 1.0.151
• (deps) bump clap from 4.6.1 to 4.6.4
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps-dev) bump the npm-all group in /ui with 2 updates
• (deps) bump taiki-e/install-action from 2 to 2.85.4

Fixed

• (ui) bundle highlight.js theme CSS instead of loading from CDN
• (web-ui) widen session token to 32 chars
• (db) escape LIKE wildcards in crate search
• (webhooks) add connect/request timeouts to webhook HTTP clients
• (web-ui) return the reset user's name from reset_pwd
• (kellnr) apply restrictive CSP to user-uploaded docs
• (common) validate OriginalName on deserialize
• (registry) bounds-check publish payload parser
• (web-ui) set HttpOnly and Secure flags on session cookie