♻️ (pmails/_exclude.erb): remove .live scope from event dropdown to include all events
♻️ (organisation_associations.rb): simplify featured_events queries by removing redundant scopes and using direct associations

🔥 Remove deprecated include_in_parent flag and replace events_for_search with events_including_cohosted.live

• Drop all references to the obsolete include_in_parent field
• Swap out custom events_for_search scope for the clearer events_including_cohosted.live chain everywhere

🐛 Extend bot blocking to cover search param in addition to q

🐛 (payments.erb): add data-sort attribute to created_at cell Enable correct chronological sorting in the payments table by exposing a machine-readable timestamp while keeping the human-readable display.

🎨 (payments.erb): replace inline ERB output with safer block syntax

🐛 Fix HTML escaping in payments view to render icon

🐛 (payments.erb): remove membership filter to show all gathering payments

✨ Add payments listing page for gatherings

• Create GET /g/:slug/payments route to display payments
• Add link from budget summary to new payments page
• Introduce payments.erb view with DataTable for sorting

🐛 (rack_attack_throttle): add missing “-bot” pattern to bot detection

♻️ Refactor bot pattern list for clarity and maintainability

🔒️ Fix XSS vulnerability in blocklisted responder

♻️ (rack_attack_throttle.rb): replace hard-coded path list with regex patterns to support dynamic org slugs
🐛 (rack_attack_throttle.rb): block requests with no referer on protected paths to stop direct bot hits
🚀 (rack_attack_throttle.rb): return JS redirect for blocked requests to gracefully handle browser users

🐛 (rack_attack_throttle.rb): replace regex patterns with exact path matching to reduce false positives
✨ (rack_attack_throttle.rb): include request path in throttle key to allow per-path rate limits for bots

♻️ (rack_attack_throttle.rb): rename rules for clarity and remove redundant comments

♻️ Extract bot/protected-path checks into lambdas Reuse the same logic in blocklist and throttle rules

🔒️ (rack_attack_throttle.rb): replace deprecated request.is_crawler? with explicit bot pattern check to fix deprecation warning

♻️ Rename Rack::Attack rules for clarity and consistency

♻️ (app.rb): move Rack::Attack after Rack::CrawlerDetect so bot detection works correctly
♻️ (rack_attack_throttle.rb): replace custom BOT_USER_AGENT_PATTERNS with request.is_crawler?

🔒️ (rack_attack_throttle.rb): add .ics endpoints to protected paths to prevent bot abuse

🐛 (rack_attack_throttle.rb): expand bot user-agent patterns to catch more crawlers