:warning: Security fixes

• Fix LaTeX sanitization to prevent malicious users from running unsafe LaTeX commands through specially crafted abstracts or contribution descriptions, which could lead to the disclosure of local file contents or remote code execution due to additional vulnerabilities in TeXLive (CVE-2026-33046) It is highly recommended that you run LaTeX builds in a container; see the upgrade docs on how to do this.

[!NOTE] If you do not use server-side LaTeX features, then you are not affected by this vulnerability. You can check whether XELATEX_PATH is set in indico.conf: if it is, then the vulnerability affects you.

:tada: Improvements

• Allow bulk (de-)selecting data in tables with shift+click (#7375, [#7376])
• Add new permissions that grant only moderation and checkin permissions for registrations (#7306, thanks @moliholy, @unconventionaldotdev)

:bug: Bugfixes

• Fix paper file submission when a filename template is configured (#7381)
• Fix selecting existing paper files when submitting an editable (#7381)
• Use symlink mtime instead of target mtime when cleaning up old temp/cache files (#7388)
• Fix fully conditional registration form sections not showing up correctly in Safari (#7393, [#7398])
• Do not allow changing registration form sections containing conditional fields to manager-only (#7392, thanks @SegiNyn)

:wheelchair: Accessibility

• Timetable toolbar buttons ("Detailed view" etc.) are now keyboard accessible and readable by screen readers (#7374, thanks @foxbunny)
• Timetable day navigation tabs can now be operated with the keyboard: the previous/next scrollbuttons are focusable and activatable, tabs respond to arrow key navigation, and all interactive elements have visible focus rings (#7386, thanks @foxbunny)

:wrench: Internal Changes

• Add more endpoints that shouldn't be crawled to robots.txt (#7390)
• Allow running TeXLive sandboxed in a container instead of installing it globally and running it directly as the indico user (#7384)