:warning: Security fixes

• Fix a legacy API giving access to profile details of other users due to a broken authorization check (CVE-2025-59034, thanks @inkz)
• Fix an XSS vulnerability in the LaTeX math rendering code applied to contribution descriptions (CVE-2025-59035)

:tada: Improvements

• Add a CAPTCHA and rate limiting to the material package endpoint, and an event setting to restrict who can generate one (defaults to managers only) (#6996)
• Add support for custom event reminders with freely chosen subject and body, and allow rich-text for the custom message in standard reminders (#6989, thanks @tomako, @unconventionaldotdev)
• Allow specifying a maximum session lifetime via SESSION_MAX_LIFETIME beyond which it cannot be refreshed by activity (#7030)
• Make displaying corresponding author email addresses in the Book of Abstracts opt-in (#7002, thanks @adamjenkins)
• Allow selecting which invitees to remind on the invitations list (#6804, [#6918], thanks @duartegalvao, @unconventionaldotdev)
• Add option in the invitation form to lock registrations to the specified email address (#6803, [#6972], thanks @duartegalvao, @unconventionaldotdev)
• Add plugin support for scanning custom QR codes in the Check-in app (#6954, thanks @SegiNyn)
• Add new tags column to the Editable list (#6614, [#6615])

:bug: Bugfixes

• Fix missing spacing between toolbar button groups (#6981)
• Fix error with certain registration form field types if the badge text overflow behavior was set to "resize" (#6993)
• Fix not being able to update a registration if an accommocation field was added after registering and the user already paid for the registration (#7000)
• Fix registration form field type selector not being fully visible on smaller screen widths (#7012, [#7013])
• Fix user search not working for admins in room booking module with no rooms defined (#7016, [#7017], thanks @behackl)
• Fix author contribution list not showing any other contributions (#7025, [#7049], thanks @diksharai9)
• Fix some LaTeX strings being rendered incorrectly and/or breaking the timetable PDF generation (#7068)

:wheelchair: Accessibility

• Use proper heading hierarchy (H3 instead of H4) for date headings on category event list pages (#7038, thanks @foxbunny)
• Add accessible labels to extra slots dropdown fields in registration forms (#7039, thanks @foxbunny)
• Use proper semantic heading elements for registration form section titles (#7040, thanks @foxbunny)
• Improve screen reader + keyboard support in the registration form picture field (#7064, [#7065], thanks @foxbunny)

:wrench: Internal Changes

• Remove broken support for custom multipass providers setting a maximum session lifetime; use SESSION_MAX_LIFETIME instead (#7030)
• Use Biome to format JS/JSX, TS/TSX, JSON and CSS (#7042)
• Add the env var INDICO_TEST_USE_DOCKER, which allows for tests to be run on a PostgreSQL server running in a container