docs(changelog): note the empty-password hardening in 3.3.7 (#8262)

Claude-Session: https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: JohnMcLear

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ### Notable fixes
 
+- **Auth — an empty-string password is refused on both login paths (#8261).** A `settings.users` entry configured as `"password": ""` authenticated anyone who submitted an empty password, on the OIDC interaction path and on HTTP Basic. Both already failed closed for a nullish password; an empty string slipped through because it is a string and compares equal to an empty submission. Only explicit misconfiguration produces it, so this is hardening rather than a vulnerability. Reported by Wenhao Wu (Southeast University) while verifying the fix for GHSA-62cj-9j72-mfrh.
 - **Admin — the plugin catalog no longer offers deprecated or known-broken plugins (#8246).** The "Available plugins" list was built straight from the plugin feed, so any package the feed knew about could be installed from the admin UI — including packages npm marks deprecated, packages the plugin registry itself could not get working against the current release, and `ep_adminpads2`, which is archived upstream and takes over `/admin/pads` with a template whose scripts core no longer ships, hanging the admin page on "Loading…". Those are now filtered out of the catalog, the admin UI refuses to install one if a stale page asks for it anyway (`pnpm run plugins i ep_<name>` on the server still overrides), and an already-installed plugin in that state is flagged as deprecated in the *Installed plugins* list. The npm deprecation lookup is cached for 12 hours and fails open: if the registry cannot be reached the full catalog is still listed. Reported by @JohnMcLear.
 
 # 3.3.6