[mrubens]

Promote v1.19.7

Frozen at fb5e231dff36d13eb83391e70dae505e58e0a59c — the commit where 1.19.7 was versioned. Commits merged to develop afterward require an explicit candidate refresh or ship in the next release.

• Merge this PR with a merge commit (do not squash or rebase).
• If multiple promote PRs are open, merge them in version order (oldest first).
• Monitor CI and reviews on this PR's current head, not only the release-preparation PR. Unresolved findings and missing required approvals remain blockers even with green CI.
• After a refresh or CI reconciliation, re-check the new head; monitoring never authorizes merging or publication.
• Merging publishes a GitHub Release for v1.19.7 and triggers the existing GHCR v* image publish (latest channel).
• The release/v1.19.7 branch can be deleted after this PR merges.

Changelog

1.19.7 (2026-11-01)

Roomote 1.19.7 strengthens runtime security while keeping your existing sign-in and task workflows familiar.

Highlights

• Includes security updates for request parsing, input validation, Microsoft authentication, and URI handling.

Patch changes

• Update runtime dependencies to address security issues in request parsing, input validation, Microsoft authentication, and URI handling while preserving existing sign-in, account-linking, and task workflows.

[roomote-community]

No code issues found. See session

Reviewed the runtime dependency updates, Zod 4 parsing and JSON Schema compatibility changes, MCP nullable-optionals handling, and release metadata. Current-head lint, type checks, Knip, amd64 app/worker builds, backup restore, and upgrade compatibility checks passed; tests and additional build/security checks were still running at the last check. This is a code-review result, not release approval.

_{Reviewed fb5e231}