GHSA-xvmf-cfrq-4j8f: shared user API authorization
GHSA-9hhh-g2fc-r8x2: CSS injection in markdown
Notable features
Household setup page in welcome stepper
Full changelog
added Household setup page and default creation to welcome stepper
added django migration records to admin
fixed food shopping sub endpoint not validating amount and unit inputs https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554
fixed a shared user could make changes to a book trough the API https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f
fixed style tags allowed in rendered markdown could lead to CSS injection in third party clients that did not properly clean the output on the frontend https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2
fixed recipe batch update endpoint could be used to update private recipes of other space members if the ID was known https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-v8x3-w674-55p5
fixed performance issues on some admin views
fixed admins can accidentally lock themselves out of their space
fixed category order jumping in shopping list when checking and not having any supermarket selected #4446
fixed selecting no supermarket in shopping not working
removed shopping list entries and meal plans from previously shopping shared users being shown
