## phasehq/console — v2.74.0…v2.75.0

_34 commits._

### Features
- **feat: add CSRF protection (#1008)** (f76512b)

### Fixes
- **fix(frontend): preselect Vercel production env and clear stale sync selections (#1009)** (89de18b)
- **fix: validate env and principal bindings in SSE init, env creation, and SA handler flows (#1001)** (ebfad3b)
- **fix(frontend): address Next.js 16 review findings** (9c33d4c)
- **Merge pull request #972 from omlahore/fix/naive-datetime-expiry** (9688f0d)
- **Merge branch 'main' into fix/naive-datetime-expiry** (8679c8d)
- **Merge pull request #995 from phasehq/security/fix-sa-credential-boundary** (b235f6a)
- **Merge branch 'main' into security/fix-sa-credential-boundary** (39d3e98)
- **Merge pull request #996 from phasehq/security/fix-secret-token-auth** (3a8068f)
- **Merge branch 'main' into security/fix-secret-token-auth** (520b2a1)
- **Merge pull request #993 from phasehq/security/fix-default-role-immutability** (263a668)
- **Merge branch 'main' into security/fix-default-role-immutability** (248cfff)
- **Merge pull request #992 from phasehq/security/fix-legacy-secret-scope** (b6306de)
- **fix: exclude soft-deleted secrets from updates and preflight rotating-secret checks** (c192966)
- **fix(backend): store token expiry as UTC instead of server local time** (15c90ac)
- **fix: make managed roles immutable** (1d74cc4)
- **fix: remove unsafe environment key mutation** (45b294c)
- **fix: secure secret token bootstrap** (f0ae23e)
- **fix: protect service account credential boundaries** (3515453)
- **fix: scope legacy secret mutations to environment** (6489c2f)

### Backend
- **Merge pull request #1015 from phasehq/codex/bump-v2.75.0** (2c72038)
- **Merge branch 'main' into codex/bump-v2.75.0** (324bbd5)
- **Merge pull request #1016 from phasehq/codex/bump-posthog-js** (a1a1085)
- **Merge pull request #998 from phasehq/upgrade/nextjs-16** (eacd0ff)
- **Merge branch 'main' into upgrade/nextjs-16** (b684b53)
- **Merge branch 'main' into upgrade/nextjs-16** (c53628c)
- **Merge pull request #994 from phasehq/security/remove-create-environment-key** (7034db4)
- **Merge branch 'main' into security/remove-create-environment-key** (4ace1f5)

### Chore
- **chore(frontend): bump posthog-js to v1.428.9** (ac2f763)
- **chore: bump version to v2.75.0** (00a0d97)
- **chore(frontend): condense build config comments** (da7ce37)
- **chore(frontend): build production bundles with Turbopack (#1012)** (234580c)
- **chore(frontend): upgrade to Next.js 16** (9d3cad5)
- **refactor: tidy service account credential-boundary comments** (ead9b03)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/phasehq/console?utm_source=github-action)._