NeoFrag Reborn 1.2.1

Security

• Two vulnerabilities fixed in the Markdown library (league/commonmark 2.10.3): a denial of service through tables crafted to slow down the server (high severity, GHSA-3q6v-r5mr-hxv8), and a bypass of the filter that strips disallowed HTML (moderate severity, GHSA-97jj-33gv-5xf9). Made public on September 21, 2026. The HTML sanitizing library (ezyang/htmlpurifier 4.19.1) also moves to its latest version.

Fixed

• Monitoring no longer reports present files as "missing". Since 1.2.0 was released, it compared the site with the official file list of the version, but excluded the Sass sources (style files before compilation) only on the site's side: four files wrongly reported missing, and a health status of "The ship is sinking!".

Changed

• A core update is recorded in the audit log: who started it, when, from which version to which version, how many files were written and how many old files were removed. Until now it was written to the error log, where it looked like an anomaly.