Added:
- SSRF protection bypass via CGNAT addresses, also adding to `ALLOW_IANA_RESTRICTED_ADDRESSES` behaviour (referenced as ghsa-gwph-fp79-379w).
- Improved validation for stored CSS injection via the `tag_colour` field (referenced as GHSA-4j9m-cxq4-9c36).

Changed:
- Improved URL filtering (referenced as GHSA-56fq-63vj-9992).
- Fixed RSS pubDate being wrong on any non-UTC container where local time was incorrectly labelled as UTC.
- Added feature allowing a watch or group to append to the inherited AI Change Summary prompt.

Removed:
- Nothing to report.