···11+# main (unreleased)
22+33+## Security
44+55+> [!NOTE]
66+> For security announcements, we encourage adopters to subscribe to the [security-announce@roost.tools mailing list](https://groups.google.com/a/roost.tools/g/security-announce).
77+88+- Routine dependency package upgrades to address vulnerabilities
99+- See [Security and quality](https://github.com/roostorg/community/security) for published security advisories
1010+1111+## NCMEC
1212+1313+- Added `email` as a supported schema field role for user items, ensuring inclusion and validation for NCMEC reports (#840, #842)
1414+- `EMAIL_ADDRESS` added as a first-class scalar in `@roostorg/coop-types` (v2.4.0) (#841)
1515+- Auto-populate user report history, original filename, and file relevance for NCMEC reports (#855)
1616+1717+## Review Console
1818+1919+- Added User Strikes count to job and item investigation views (#766)
2020+- Added decision reasons to recent decisions view and CSV exports (#772)
2121+- Split "require decision reason" into separate action and ignore settings (#780)
2222+- Fixed duplicate entries in recent decisions (#774)
2323+- Empty threads are no longer hidden (#804)
2424+- Improved Review Console dashboard display by ellipsizing long queue IDs (#849)
2525+- Improved moderator textarea placeholder for clarity (#711)
2626+- Fixed content URL rendering in the review iframe when no content proxy is configured (#777)
2727+2828+## Actions
2929+3030+- Parameterized actions now work with proactive rules and user strikes (#792)
3131+- New per-queue "clear other reports for a user" sweep action; sweep now also handles related items (#817, #835)
3232+- Added `creator` field to action webhook callbacks (#755)
3333+3434+## Investigations
3535+3636+- Added IP address lookup to investigation view (#754)
3737+3838+## Other fixes
3939+4040+- Added client-side email validation for invites (#786)
4141+- Express session store now properly closed on API shutdown (#825)
4242+4343+## CI & infrastructure
4444+4545+- Server integration tests now run in CI (#827); basic Playwright E2E test suite added (#823)
4646+- Server tests isolated via transaction rollback (#732)
4747+- TypeScript type-checking added for `db` and `migrator` in CI (#782)
4848+- Prettier enforced globally in CI (#834)
4949+- GitHub Actions updated to Node 24 runtime (#795)
5050+- `zizmor` added to lint CI workflows for security issues (#721)
5151+- Knip added across all packages to remove unused dependencies (#734, #760, #761, #762)
5252+- Redis user/password now correctly set in no-cluster mode (#747)
5353+5454+## New contributors
5555+5656+- @reitblatt made their first contribution in https://github.com/roostorg/coop/pull/785
5757+- @jess-upscrolled made their first contribution in https://github.com/roostorg/coop/pull/804
5858+- @ltianyi992 made their first contribution in https://github.com/roostorg/coop/pull/711
5959+6060+**Full Changelog**: https://github.com/roostorg/coop/compare/1.0.1...main
6161+162# Coop 1.0.1
263364## Review Console