fix: close the upload and playground findings from the security audit, release v2.5.0 - #1556

Merged

joshunrau merged 10 commits into

DouglasNeuroInformatics:mainfrom

joshunrau:fixes

Sep 22, 2026

Commits on Sep 22, 2026

docs: add the odc-open-pr skill

joshunrau
and
claude
committed
5828163
chore: add odc-commit skill
joshunrau
committed
f164edc
fix(api): return only the records an upload wrote, not every group's
joshunrau
committed
49fd5a9
fix(playground): run instrument previews on a second origin
joshunrau
committed
66c1425
fix(playground): keep the desktop layout in the preview frame
joshunrau
committed
35e5ef1
chore: release v2.5.0
joshunrau
committed
7de15de
refactor(api): name the admin-only route access declaration
joshunrau
committed
031e9e4
fix(api): make every user write admin-only
joshunrau
committed
6cc9ec3
fix: stop offering user grants that only an administrator can use
joshunrau
committed
14d5bdc
feat(web): warn that granting manage all makes a user an administrator
joshunrau
committed
d4be83f