v1.13.7

* SECURITY
  * Update to bluemonday-1.0.6 (#15294) (#15298)
  * Clusterfuzz found another way (#15160) (#15169)
* API
  * Fix wrong user returned in API (#15139) (#15150)
* BUGFIXES
  * Add 'fonts' into 'KnownPublicEntries' (#15188) (#15317)
  * Speed up `enry.IsVendor` (#15213) (#15246)
  * Response 404 for diff/patch of a commit that not exist (#15221) (#15238)
  * Prevent NPE in CommentMustAsDiff if no hunk header (#15199) (#15201)
* MISC
  * Add size to Save function (#15264) (#15271)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEtfCRWBNVTDLB1ZnCyZuC5AsCe64FAmBt0kYACgkQyZuC5AsC
e65vpRAAtoVp+ed9ME/FpZbBOxqc9Q4py/E1lOCZmlvIocDt04g/bEq/hQH3Vaj4
Fvlqr6tmUuwFwg9emffyDhH6JGpg0a4/YdEHBRYsUi7NSHFx/TvVfxniHRzSG4Qu
F8a8LFFgBhy0vYekJX9+Ip3loI8KftLfmMRqghYd2l2vmxb9pFRZTaRFaonNE8mK
XcfEOzS4Il9ghdGWumdCgxg88jnMDawfZl48o+tvFi2/i1jtPWKQmSSFlukCabjT
C+milGjLiofr2/YKWi7kUrdZUSsyfH2BZBu2R7tGpoVF1sB54Mv++08RFDPVGg0V
Azw+2X6u2KSS3V1g9OtNIjXLnq7vraZ06EPV/NPoLZfv7BaTL9uvyorlggWlAAZv
qbnrPoDqvMs9v4GoPHiIeInd490XUVfZSedLZfny1FYcGOhaebFJPzRfVZcCDblC
KgG0Akah307udDsJT2kHz36M70Pqwy+RHiRf1w9HZ4qjfUd8MTHJ5bL++L40Gd6E
e9bss62zJaXZ6j9mUDZBLwpmohxqzGgZIHOL1IwSw6Q7/N0c5opdJwyLTmP1RNbd
76diGh3EW74jGL63hC6DHzb5zv6I39lGikLH5aoTo0zDjQySu4XedVLqpF41Qtfa
Hed3qbjkEZul0IoRt5pIXmqCS7k8MCFBBjAujRmsnv/Y6e6xc1o=
=HBQN
-----END PGP SIGNATURE-----