- Escape HTML in client list and wake-on-LAN names to prevent XSS - Log successful/failed login attempts with remote address - Fix leading-comma bug in AllowedIPs template when only extra allowed IPs are set - Add PreUp script support for server interfaces (alongside existing PostUp/PreDown/PostDown) - Fix endpoint parsing to support IPv6 addresses (upstream PR #223) Cherry-picked from upstream PRs #656, #653, #680, #673, #223. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>