As I know, nothing changed. I run a UNA hosted cloud4 without access to the server/files

The only injection is a cookie consent in , the only java on pages is the one to fit the height of iframes in posts (I remember you did) This java snippet is not in an active block atm