2.6.4

Security release, self-hosters should upgrade.

Fixes:

Connect: a rejected promise ended the worker
Connect: a dead worker took the whole site down instead of being replaced
Connect: client resets restarted the site
Connect: www.clearflask.com returned a 500 on every page
Connect: SSR redirects answered with the Location alone
Connect: hardened SSR against subdomain-enumeration floods
Connect: banlist strikes counted by unique 404 target, not raw hits
Server: 404 instead of 500 for a project that does not exist
Server: handled API errors kept out of the SEVERE log
Server: quiet noisy WARN on malformed client-supplied auth tokens
Build: try Maven Central before jitpack
Deploy: target the singlehost by a dedicated tag, fail when nothing matches
Deploy: connect-only and server-only targets ran the full deploy
Comment search returned comments on Private posts to anonymous callers
ideaCommentSearch now returns 404 for a Private post unless the caller is an admin or moderator
commentSearch excludes comments on Private posts for everyone else

Changes:

If you are interested in hearing about new features in our product