Bump version to 1.9.5

2026-08-27 09:35:58 +02:00
parent 7e235637c4
commit 98ac26bf70
4 changed files with 5 additions and 3 deletions
@@ -7,6 +7,8 @@ and this project follows [Semantic Versioning](https://semver.org/).

 ## [Unreleased]

+## [1.9.5] - 2026-08-27
+
 ### Fixed

 - The public event-alias route (`/:redirectUrl`, used for short links like `/camp-2025`) is a catch-all matching any unmatched top-level path, so every bot/scanner probe for a nonexistent page (`/wp-login.php`, `/.env`, etc.) was hitting the backend and firing a live database query. Both the frontend route and the `GET /api/events/by-alias/:redirectUrl` endpoint now reject anything that isn't a plausible alias (letters/numbers/hyphens/underscores) before touching the database, instead of forwarding scanner noise straight through — this traffic pattern could exhaust the database connection pool and take the server down under load.