# v0.6.1

**Released:** 2026-07-19

Changes since v0.6.0 (`f0a90fc`..merge of #119).

## Security

- **Enforce CSRF on the upload endpoints** (PR #119 by @gabrielforster, closes #118): The image, media, and AI upload actions no longer `skip_forgery_protection` — they now inherit the app-wide CSRF check like every other mutating request. With the editable S3 destination key from v0.6.0, a cross-site POST to a user's FrankMD (localhost / LAN / tunnel) could otherwise have passed an arbitrary `s3_key` and overwritten any object in the configured bucket. The seven affected actions are `images#upload`, `images#upload_to_s3`, `images#upload_external_to_s3`, `images#upload_base64`, `media#upload`, `ai#fix_grammar`, and `ai#generate_image`. No client change was needed: every in-app caller already posts through `@rails/request.js`, which attaches the token from `csrf_meta_tags`. A new `test/controllers/upload_csrf_test.rb` asserts each endpoint rejects a token-less POST with 422.

## Test Coverage

- 582 Ruby tests, 1,434 JavaScript tests (2,016 total).