✨ Add slug generation to library films based on name

🏷️ Make slug human-readable

The slug is now based on the book title instead of the book ID, to be more readable in URLs.

♻️ refactor library books loading to use separate dandelion_books list

Replace inline dandelion flag filtering with a join against a dedicated dandelion_books CSV to determine which books to display. Normalize CSV keys to snake_case symbols and merge in derived fields (slug, cover image, publication year) at load time so callers no longer need to know about the underlying Goodreads schema. Simplify controller and view to consume the unified library_books list.

🔥 remove book detail page and always redirect to goodreads

The custom book detail page is removed in favor of always redirecting users to the Goodreads page for the book. This simplifies the library feature and ensures users always see the most up-to-date book information from Goodreads.

♻️ Migrate library data source from Airtable to CSV files

Replace Airtable-backed Book and Film models with CSV-based helpers that fetch data from a GitHub-hosted repository. This removes the airrecord gem dependency and eliminates the need for Airtable API credentials, simplifying the data pipeline and reducing external service reliance.

🦺 (local_group.rb, _map.erb): add validation for GeoJSON Polygon and MultiPolygon types to prevent rendering errors with invalid geometry data

🔒️ Upgrade oauth2, crass, excon, json, and websocket-driver for RubySec advisories

🛂 Add viewable? permission checks to account routes

Restrict access to following, organisations, local_groups, activities, gatherings, and followers endpoints by kicking unauthorized users before rendering the partial.

🦺 Add Gathering#protected_attributes and prevent currency mutation

🔒️ Escape event redirect_url in post-checkout JS redirect

Prevent organizers from breaking out of the window.location string via crafted redirect URLs.

🔒️ Switch destructive routes from GET to POST

Destructive actions were previously exposed as GET endpoints, making them vulnerable to CSRF and accidental triggers (image tags, link prefetching, etc.). Convert all */destroy and */hard_destroy and */refund_and_destroy routes to POST across controllers.

Update app.js and pagelets.js to detect destroy links and submit hidden POST forms so existing UI keeps working.

Rename orders/confirm_destroy to confirm_cancel (with redirect for backwards compatibility) and update email/notification templates and tests accordingly.

🔒️ Block SSRF in ATProto OAuth discovery and DID resolution

🔒️ Escape user input in notification text to prevent XSS

Add expiry and purpose to Stripe Connect OAuth state tokens

Extend TokenVerifier with optional expires_in and purpose, then use a 15-minute stripe_connect purpose for OAuth state to limit replay while keeping reload tolerance.

Fix Stripe Connect OAuth state surviving page reloads

Replace session-stored random state with signed TokenVerifier tokens so each authorize URL remains valid even if the org page is re-rendered before callback.

🔒️ Sanitize HTML and add CSP header to public pmail endpoint

Harden public pmail rendering against XSS and unsafe content:

• Add Content-Security-Policy header on the public pmail route to restrict resource loading.
• Sanitize both markdown-rendered and raw email bodies via Sanitize.fragment using Sanitize::Config::DANDELION to strip dangerous tags/attributes before they reach the browser.
• Replace javascript:; placeholder link in mailer docs with a real https URL to avoid encouraging unsafe link patterns.

🔧 Upgrade Cursor model variant to xhigh in bug review workflow

The grok-4.5-xhigh variant provides deeper reasoning capabilities, which should yield more thorough and accurate bug detection in the daily automated review.

👽️ Switch Cursor model from composer-2.5 to grok-4.5 in daily bug review workflow

🔥 Remove obsolete .windsurf/workflows symlink pointing to ../commands

🔒️ Prevent XSS via uploaded files Add RejectsActiveContent concern to Attachment, Comment, and Upload models to block active content (html, htm, xhtml, svg, svgz, xml, js) from being uploaded. Return proper error messages on upload and comment failures.