Account names may contain only letters, digits, underscores, dots and hyphens, and users with other names are refused at registration and skipped at startup
Access directory permissions on read-only drives now apply to directory names that contain spaces or special characters, and refreshing them no longer stacks another mount on the directory
User full names containing quotes or other punctuation no longer break account creation
Reading a file at its end now returns no data instead of an error, and a single read is limited to 16 MiB so one request can no longer exhaust the controller's memory
VM passwords, including the root password, and the VPN secret are now generated with a cryptographically secure random generator. Before, a VM user could work out the root password from a password the controller generated for them
Changing the permissions of a user who is not on the VM no longer crashes the VM controller. Changing a user's permissions or role now reports an error instead of crashing when the VM is missing the SFTPAccess or Managers group
Attaching several drives at once no longer gives two drives the same mount path or drive letter, which could unmount a drive that was already attached. Attaching a drive that is already attached now returns an error instead of mounting it a second time
NFS drives are now always mounted read-only on the VM. An unreachable NFS server no longer hangs detaching the drive or the VM's drive usage statistics
On Linux VMs, attaching an NTFS drive no longer puts its BitLocker key on a command line that other local users can read. A drive's name can no longer run commands or move its decryption mount outside /decrypt
Files transferred into a Linux VM are owned by the user again, so the user can edit them. A VM user can no longer trick a transfer into overwriting system files
