:warning: Security fixes

• Fix an XSS vulnerability when resolving conflicts between concurrent edits to minutes (GHSA-cw24-x4mj-fw3q)
• Fix an XSS vulnerability in various places that allow entering custom links (GHSA-c4wc-ggrj-jg9v)

[!NOTE] The risk of these vulnerabilities is relatively low, because for the minute editor both the attacker and the victim would need to collaborate on the same minutes (ie have privileges to edit them), and the others require at least submitter or management access in an event and additionally an interaction (clicking the link) by the victim.

• Fix a missing access check in the legacy session export API (GHSA-6p4f-j8j6-463q)

[!NOTE] This only affected sessions that were more protected than the surrounding event, and in this case the API could have been misused to retrieve metadata (such as title, description and conveners) of such a session.

• Fix an incomplete SSRF check (GHSA-2v95-h47v-g4x9)

[!NOTE] Just like for the previous SSRF fix, there was only one place where this would have allowed returning data retrieved from such a URL to the client, and this was only accessible to authenticated users with event management privileges. Also, this vulnerability is only problematic if sensitive information is accessible via an unauthenticated HTTP GET request (e.g. in AWS cloud environments).

:flags: Internationalization

• New translation: Korean

:tada: Improvements

• Include keywords in contribution CSV/Excel exports (#7421)
• Add new permission that grants only participant management (create, edit and delete registrations) without access to the registration form configuration (#7419, thanks @moliholy, @unconventionaldotdev)
• Add internal name for registration form fields (#7276, [#7485], thanks @tomako)
• Add a "Code" (short name) to predefined affiliations (#7400, thanks @duartegalvao, @unconventionaldotdev)
• Track the last modified timestamp of registrations (#7478, thanks @jbtwist)
• Pre-fill the registration form picture field with the user's custom profile picture when available (#7447, thanks @moliholy, @unconventionaldotdev)
• Allow users to mark contributions as favorites (#3524, [#7256])
• Allow choosing whether to clone registration tags (#7506)
• Add placeholders for contribution link and board number for emailing contributions (#7525, thanks @duartegalvao)
• Add a weekday option to the contribution schedule email placeholder (#7526)
• Allow managers to override accommodation date range validation when editing registrations (#7415, [#7433], thanks @moliholy, @unconventionaldotdev)
• Automatically paste obvious email addresses into the email field when pasting in the user search dialog (#7538)
• Allow changing/removing the registration fee of pending registrations (#7572)
• Add QR code generator to event share widget (#6796, [#7504])
• Add contribution link placeholder for emailing abstract roles (#3602, [#7569])
• Allow cloning survey sections (#7395, [#7536])
• Add "Affiliation" field type to regforms (#7352, thanks @duartegalvao, @unconventionaldotdev)
• Log registration tag changes in the event log (#7446, thanks @moliholy, @unconventionaldotdev)
• Display embedded images in email log entries (#7338, thanks @duartegalvao, @unconventionaldotdev)
• Record who created a registration on behalf of someone else (#7629, thanks @moliholy, @unconventionaldotdev)
• Support attaching files when emailing event persons (#7369, thanks @jbtwist)
• Let registration managers view logs for specific registrations (#7600, thanks @vtran99)
• Add pagination to public participant list and use tabs instead of an accordion in case of multiple registration forms (#6424, [#7472])
• Add new registration form setting to require approval again after a user modifies their registration (#7434, thanks @moliholy)
• Add support for anonymous accompanying persons (numeric count only) in registration form (#7383, [#7427], thanks @mkreuzmayr, @andi1479)

:bug: Bugfixes

• Correctly restrict user access to their logs (#7404)
• Correctly restrict access to draft contribution list (#7408)
• Use new MS Outlook URL in the share widget (#7424, thanks @hirishh)
• Fix editing contribution time from timetable bubbles when the CSP is enabled (#7432)
• Fix error when copying a paper file with an unguessable MIME type to the editing module (#7475)
• Fix date picker showing January instead of the selected month when the user language is not English (#7471, [#7476], thanks @foxbunny)
• Do not show "Clone Abstract" icon outside management area (#7493)
• Allow rejecting editables w/ missing required files (#7524)
• Fix select and combobox dropdowns appearing detached from their input on mobile when the page is pinch-zoomed, when the input is near a viewport edge, or when the virtual keyboard is open (#7529, thanks @foxbunny)
• Fix database error when importing protection settings in an unlisted event (#7550, [#7551])
• Use consistent sorting and hide deleted+unused single-choice options in registration list filters (#7439, thanks @duartegalvao)
• Honor room booking details restrictions in spreadsheet export (#7612)
• Show favorite events in the dashboard based on their end date instead of their start date (#7653, thanks @SegiNyn)
• Reduce max filename length in ZIP downloads to avoid issues on Windows (#7479, @moliholy)
• Correctly format dates containing literal strings, such as "30 de junho" (#7590, [#7668])
• Avoid serving incomplete webpack manifests during concurrent requests (#7530, [#7675], thanks @shuv-amp)
• Fix missing fonts in Offline Copy archives (#7697)
• Reject invalid email addresses when entering person details (#7644, [#7698])
• Allow saving minutes after using the "Mark" formatting button in the editor (#7700)
• Fix room booking sprite image creation failing when there are many rooms (#7704)
• Use correct timezone information in log viewer (#7712, thanks @SegiNyn)
• Fix a small gap that could appear between a tooltip and its arrow when the tooltip is attached to a control with a smaller font size (#7718, thanks @foxbunny)

:wheelchair: Accessibility

• Screen reader users can now navigate to the event page header as a banner landmark (#7418, thanks @foxbunny)
• Icon-only buttons on the abstract detail page now have proper accessible names and tooltips instead of relying on the title attribute (#7474, thanks @foxbunny)
• Screen reader users can now navigate to the footer link list as a named navigation landmark (#7559, thanks @foxbunny)
• Screen reader users can now navigate the dashboard sections as second-level headings instead of a flat run of same-level headings (#7581, thanks @foxbunny)
• Screen readers now correctly recognise modal dialogs as modal, keeping navigation within the open dialog (#7570, thanks @foxbunny)
• Screen reader users can now access the full date range and timezone for events in the dashboard lists, which was previously shown only as a mouse-hover tooltip (#7608, thanks @foxbunny)
• Screen reader users are now given a plain-text summary of the call for abstracts / call for papers submission period instead of hearing the decorative opening-day / deadline timeline graphic (#7487, thanks @foxbunny)
• Screen reader users can now navigate to the main page heading on the dashboard, user profile, preferences and category pages, which previously showed the page title as plain text with no heading (#7617, thanks @foxbunny)
• The abstract submission ID is now easier to read for users with low vision (#7463, thanks @foxbunny)
• Screen reader users can now reliably hear their relationship to each event in the dashboard's "Your events at hand" list (management, reviewing, attendance and favourite status), which was previously exposed only through role-icon tooltips that assistive technology did not announce dependably (#7589, thanks @foxbunny)
• Screen reader users now hear the affiliation, email and phone on their profile dashboard announced as labelled fields instead of bare values (#7593, thanks @foxbunny)
• The calendar export buttons on category, session and contribution pages now show a tooltip on hover and keyboard focus and have a reliable accessible name, instead of relying on the title attribute (#7718, thanks @foxbunny)
• Icon-only controls in the event header toolbar (home, event navigation, export, download, theme, favourite and management) now have reliable accessible names and tooltips that also appear on keyboard focus, instead of relying on the title attribute (#7623, [#7689], thanks @foxbunny)

:wrench: Internal Changes

• Modernize the PDF registrant list generation using weasyprint (#7077, thanks @abhinavohri)
• Relax the videoconference name length limit to 255 characters, delegating service-specific limits to each plugin (#7560, thanks @moliholy, @unconventionaldotdev)
• Modernize the scientific program + session list PDF generation using weasyprint (#7694)
• Use the latest TeXLive container image (TL2026-2026-08-09-full) for LaTeX-based PDF builds (#7699)