v0.31.4

CHANGELOG.md

@@ -3,6 +3,13 @@
 > Operator-facing release history. Historical engineering notes are kept in
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.31.4
+
+- Correct the administration panel's handling of intermittent `auth.invalid_origin` with optional explicit HTTPS `administration.public_origin` when behind a trusted reverse proxy. Allow a bounded, HTTPS-first multi-hop forwarded-proto chain without trusting arbitrary forwarding headers.
+- Use a single public panel URL: automatically include its hostname in the panel's effective Host allowlist. Keep `allowed_hosts` as optional **additional** DNS entries in an advanced section and deduplicate legacy repeated values on edit/save without an automatic database migration.
+- Preserve strict Host, forwarded-Host, Origin, Fetch Metadata, CSRF and trusted-proxy checks; keep public proxy routes and SQLite schema unchanged.
+- Add configuration and HTTP guard simulations, Rust source regression tests, English/Polish form labels and operator documentation. Rust/Cargo build and live mobile acceptance are still outstanding.
+
 ## 0.31.3
 
 - Prevent duplicate session requests after BFCache/tab restoration; suspend SSE/polling until session validation finishes, then resume once. Replace automatic resume reload loops with a visible, localized retry screen and preserve the startup recovery limit until initialization is complete.