docs(changelog): 3.3.6 release notes

[JohnMcLear]

Adds the # 3.3.6 release notes so the patch release can be run (bin/release.ts requires the changelog to start with the version being released).

Covers everything merged since 3.3.5:

• Security: the OIDC login bypass for passwordless accounts (GHSA-62cj-9j72-mfrh, fix(oidc): refuse interactive login for accounts without a password #8247), reported by Wenhao Wu (Southeast University)
• Installer Node version check under Windows PowerShell 5.1 (fix(installer): Node version check fails under Windows PowerShell 5.1 #8235)
• Admin settings form escape sequences (fix(admin): honour escape sequences in settings form string fields #8239)
• Session transfer preferences on HTTPS and the double-encoded cookie (fix(tokenTransfer): preserve prefs on HTTPS and stop double-encoding #8238)
• Session transfer dialog wording (fix(i18n): describe session transfer as a one-time code, not a link #8236)
• Deleted pads leaving the welcome screen recent list (fix(pad): remove deleted pads from the welcome screen recent list #8237)
• Line-by-line screen-reader navigation (fix(a11y): expose plain pad lines as paragraphs to assistive tech (#7778) #8240)

The existing #8109/#8110 plugin-settings entry is kept and now sits under the fuller section. Changelog only, no code changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EVGSvGqsCVzHFPneVbLVrB

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Document the 3.3.6 security and bug-fix release

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Adds 3.3.6 release notes required by the release automation.
• Summarizes the OIDC advisory and fixes merged since 3.3.5.

High-Level Assessment

The changelog-first approach is optimal because the release script requires the target version at the top of CHANGELOG.md. The notes appropriately consolidate the security advisory and shipped fixes without introducing unrelated code changes.

Files changed (1) +12 / -0

Documentation (1) +12 / -0

CHANGELOG.mdAdd 3.3.6 release notes +12/-0

Add 3.3.6 release notes

• Adds the 3.3.6 security and bug-fix release section ahead of 3.3.5. It documents the OIDC login bypass advisory and fixes affecting installation, settings, session transfer, recent pads, accessibility, and plugin configuration.

CHANGELOG.md