Bug Fixes 5

• Display minimum length in password complexity message (#12419, #12390)

  Fixed an interpolation issue where the password complexity hint displayed the raw {{value}} placeholder instead of the configured minimum length. This was caused by an incompatibility between bigint types and ngx-translate v17.

  console
• Keep submit button disabled during password set flow (#12429, #12416)

  Ensured the submit button remains in a loading state during the entire password-set request, including the database consistency delay. This prevents users from double-clicking and triggering errors during invite or reset-password flows.

  login-v2
• Prevent crash on stale session cookies migration (#12423)

  Improved error handling when a session cookie references a session that has been removed server-side. The system now gracefully handles NotFound errors instead of crashing the server render during flows like "forgot password".

  login-v2
• Respect ignoreUnknownUsername when login is disabled for user type (#11130)

  The `ignoreUnknownUsername` setting is now correctly respected when a user is found but rejected due to login settings (e.g. `disableLoginWithEmail`), preventing user enumeration.

  login-v2
• Actions security hardening

  Hardened Actions by preventing disk access via 'require' in scripts.

  actions

Contributors 3