v0.30.2

Changed

• download_directory_as_zip: the order of entries inside the returned archive is no longer guaranteed; it now depends on the Nextcloud server's database backend, after Nextcloud server #60225 removed the implicit ORDER BY name ASC. #429

Security

• Pinned starlette>=1.0.1 to address BadHost (CVE-2026-48710): a crafted Host header could desync request.url.path from the routed path in Starlette ≤ 1.0.0, bypassing path-based authorization. FastAPI does not constrain Starlette's upper bound, so an explicit floor is required to guarantee the fix. The fastapi floor was also raised to >=0.133 (the first release compatible with Starlette 1.0+).